When you apply for a loan, you hand over your identity, your income, your bank transactions and your credit history. That is fair: a lender can’t price risk blind. But it is not a blank cheque. This guide explains what a lender can reasonably ask for, what a loan app must never touch, and what the new data protection law adds. It is part of our borrower rights checklist for India.
What a lender legitimately needs
For an unsecured personal loan to a salaried person, a lender typically needs four kinds of data. Each has a clear purpose.
| Data | Why the lender needs it |
|---|---|
| PAN, Aadhaar-based or other KYC, a photo or video check | KYC is a legal requirement for every regulated lender |
| Salary slip and salary-account bank statement | To see your income, existing EMIs and how your account is run |
| Credit report from a bureau | To see your repayment history; pulled with your consent |
| Address, employer, contact details, references | To service the loan and reach you; references only with their knowledge |
At Omozing, for example, we ask salaried applicants for two documents beyond KYC: a 6-month salary-account bank statement and the latest salary slip. You can read how we handle data in our privacy policy and data security page.
What a loan app must never take
The RBI’s Digital Lending Directions, 2025 (issued 8 May 2025) build on rules first introduced in 2022. In plain terms:
Allowed, with your explicit consent
- Only the data needed for the loan, collected after you agree.
- One-time camera, microphone or location access for onboarding or KYC.
- Sharing with a credit bureau, as the law requires.
- Storage on servers in India (offshore processing only briefly, then deleted abroad).
Not allowed
- Reading your contacts, call logs or phone functions.
- Opening your files, photos or media.
- Storing your biometric data, unless a law permits it.
- Using your data for a purpose you didn’t agree to.
The rules also give you control: you can refuse consent for a particular use, ask the lender to limit sharing with third parties, revoke consent you gave earlier, and ask for data collected through the app to be deleted, subject to what the lender must keep by law. Lenders must publish a privacy policy that names any third parties allowed to collect data through the app.
An app that asks for your contact list is telling you how it plans to collect. Close it.
Apps that demand contacts or gallery access are almost always the ones behind harassment campaigns. Our guide to spotting fake loan apps shows the pattern, and you can check any app in the RBI directory using our step-by-step guide.
The DPDP law: what changes, and when
The Digital Personal Data Protection Act, 2023 is India’s general data protection law. It applies to every business that handles digital personal data, including lenders. The Rules that make it work were notified on 13 November 2025, with a phased start.
DPDP law: the phase-in dates
As of October 2026. The government consulted in early 2026 on shortening the 18-month window, but no amendment had been notified when we checked. Confirm dates on meity.gov.in.
From 13 May 2027, a lender (a “data fiduciary” in the law’s language) must:
Give you a clear notice
An itemised list of the data it collects and the specific purpose, separate from the loan agreement’s terms and conditions.
Make withdrawing consent as easy as giving it
A specific link on its website or app. Withdrawing consent doesn’t cancel what you owe, but it stops further processing that relies on consent.
Honour your rights
You can ask what data it holds, have it corrected or completed, have it erased when no longer needed, and nominate someone to act for you if you die or are incapacitated.
Resolve grievances within 90 days
Lenders must publish how to raise a data grievance and resolve it within a reasonable time not exceeding 90 days.
Report breaches
Tell affected people without delay, and the Data Protection Board within 72 hours with a detailed report.
What the law doesn’t let you do
Data rights are strong, but they don’t erase a loan. Some limits are worth knowing so you don’t waste a request:
- You can’t delete true credit history. Lenders must report repayment data to credit bureaus, and that record stays. Wrong data is a different matter: dispute it through the lender and bureau (see how to dispute CIBIL errors).
- Lenders keep some records by law. KYC and transaction records must be retained for set periods under anti-money-laundering and RBI rules, even after you close the loan.
- Consent isn’t the only basis. Processing for legal obligations, such as reporting to a bureau, doesn’t depend on your consent.
Your practical checklist today
If a lender has shared your data with your contacts or used it to threaten you, that’s a recovery-conduct issue as well as a data issue. Follow our guide to complaining about a lender, use the data deletion letter template, and call 1930 if there is extortion.
Two documents. No phone snooping.
Omozing personal loans for salaried people need a 6-month salary-account statement and your latest salary slip. Rates start from 11% a year, and the exact cost is in your Key Fact Statement before you sign.
Frequently asked questions
Can a loan app access my contacts and photos?
No. Under the RBI’s digital lending rules, lending apps must not access your contact list, call logs, files or media. Only one-time access to the camera, microphone or location for onboarding or KYC is allowed, with your explicit consent.
When does the DPDP Act apply to lenders?
The DPDP Rules were notified on 13 November 2025. Core duties on notice and consent, your rights as a data principal and the penalty provisions apply from 13 May 2027, as of October 2026. Until then, the IT Act and RBI rules apply.
Can I ask a lender to delete my data?
You can ask a digital lender to delete data collected through its app, and from May 2027 you can request erasure under the DPDP law. Lenders must still keep records they are legally required to retain, such as KYC and credit reporting data.
Can I get my credit history erased under the DPDP law?
No. Accurate repayment data reported to credit bureaus is kept under credit information law. You can dispute and correct inaccurate entries through the lender and the bureau.
How do I know which lender checked my credit report?
Credit bureaus must send you an SMS or email alert when your credit report is accessed, where your contact details are on record. Your full credit report also lists recent enquiries.
Where do I complain if a lender misuses my data?
Write to the lender’s grievance redressal officer first. If it isn’t resolved within 30 days, escalate to the RBI on cms.rbi.org.in. For threats or extortion, call 1930 or report on cybercrime.gov.in.
Sources (checked October 2026): Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025, PIB/MeitY); RBI (Digital Lending) Directions, 2025 (8 May 2025); RBI circular on customer service by credit information companies (26 October 2023). General information, not legal advice.
Omozing is the digital lending brand of Aparampaar Finance Private Limited, an RBI-registered non-deposit-taking NBFC. See our regulatory disclosures and grievance redressal process.