Data Permissions and Privacy in Digital Lending

• Borrowers: Any individual downloading, installing, or applying for credit through a mobile application or digital web platform.
• Regulated Entities (REs): Commercial banks, cooperative banks, and Non-Banking Financial Companies (NBFCs) partnering with loan applications.
• Lending Service Providers (LSPs) & Digital Lending Apps (DLAs): Third-party fintech platforms, intermediaries, and software interfaces executing customer acquisition, underwriting, or servicing.
• Prohibited Data Categories: Mobile contact address books, call records, SMS message contents, file storage, and biometric data storage.

[Borrower Installs App]
        │
        ▼
[Permission Prompt Displayed]
        │
        ├── Prohibited Permissions Requested? (Contacts, Gallery, Call Logs, SMS)
        │       │
        │       ├── YES ──> [VIOLATION] App is operating illegally or in breach of RBI norms
        │       │
        │       └── NO  ──> Legitimate flow
        │
        ▼
[Allowed One-Time Prompts]
        │
        ├── Camera (One-time selfie/document capture for KYC)
        ├── Location (One-time geofencing to confirm Indian jurisdiction)
        └── Microphone (One-time video-KYC interaction)
        │
        ▼
[Privacy Policy & Consent Agreement]
        ├── Explicit itemised disclosure of what data is collected
        ├── Name of underwriting Regulated Entity (Bank/NBFC)
        └── Option to restrict, opt-out, or delete stored personal data
        │
        ▼
[Disbursal & Repayment]
        └── Lender cannot disclose loan status to third parties or contacts

1. Permission Audit at Install: When installing an app, examine the runtime permissions requested. Legitimate apps compliant with RBI directions will request camera access during the video-KYC stage and location access during session login. They will never trigger prompts asking for read access to your device contact list or storage gallery.
2. Reviewing the Comprehensive Privacy Policy: Before submitting an application, the app must display an explicit privacy policy disclosing the identities of the underwriting Bank/NBFC, details of LSPs handling data, specific data points retained, retention periods, and contact details of the Data Protection Officer and Grievance Redressal Officer.
3. Data Retention and Erasure Protocols: Once a loan account is closed, the borrower can submit an official request under Para 4.1 of the RBI Directions and the DPDP Act 2023 demanding deletion of non-statutory data. Financial transaction logs required under the Prevention of Money Laundering Act (PMLA) must be retained for five years by the regulated entity, but promotional data and device identifiers must be expunged.

1. Contact Scraping for Coercive Recovery

Predatory loan apps bypass standard app store review policies by bundling third-party SDKs that silently copy the borrower's entire phone book to overseas command-and-control servers. In the event of default or delayed repayment, recovery operators send automated messages, obscene morphed photos, and defamatory loan delinquency notices to the borrower's parents, colleagues, and employers.

2. SMS Parsing for Financial Scoring Abuse

Unscrupulous fintech apps request broad SMS read permissions under the guise of "evaluating creditworthiness" through bank transaction alerts. They use this access to track private communications, personal OTPs, and competitive loan offers, violating both RBI directions and fundamental privacy standards.

3. Persistent Background Location Tracking

Apps set location permissions to "Always Allow" rather than "Only While Using the App," continuously polling the borrower's GPS coordinates and mapping home, workplace, and social patterns without valid underwriting justification.

4. Illegitimate Data Sharing with Unregulated Telemarketers

Fintech entities frequently cross-sell personal contact details, income data, and borrowing patterns to unregulated third-party lead aggregators without explicit, itemised consent, leading to persistent spam calls and unsolicited credit offers.

Immediate Device Protection

• Audit App Permissions: Open your phone settings (Settings > Apps > [Lending App] > Permissions). Immediately revoke permissions for Contacts, Call Logs, SMS, Files & Media, and Background Location.
• Uninstall Non-Compliant Apps: If an app refuses to function unless you grant permission to your contact book or photo gallery, do not proceed. Uninstall the application immediately; it operates in direct defiance of RBI rules.

Action Against Violations

1. Lodge an Internal Grievance: File a formal written complaint with the Grievance Redressal Officer of the associated Regulated Entity (Bank or NBFC) citing Para 4.1 of the RBI Digital Lending Directions (RBI/2022-23/111).
2. Escalate to RBI Ombudsman: If the regulated entity fails to resolve the matter within 30 days or dismisses the complaint, escalate the grievance to the RBI Banking Ombudsman portal (cms.rbi.org.in).
3. Report to Cybercrime Authorities: If an app extracted your contacts or private photos and is issuing threats or blackmail, submit an immediate formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call emergency helpline 1930.
4. Invoke Data Protection Rights: Issue a formal notice under the Digital Personal Data Protection Act 2023 demanding complete erasure of your personal data from both the LSP's servers and third-party cloud instances.

Can a loan app legally ask to read my text messages (SMS)?

No. Under the RBI Digital Lending Directions issued in September 2022, lending apps are strictly prohibited from accessing mobile phone resources, including SMS logs. While apps historically claimed SMS access was necessary to assess cash flows via bank transaction alerts, the RBI has banned this practice to safeguard financial consumer data.

Is it legal for a lending app to ask for contact list permissions?

No. An app that demands access to your phone book or contact list is violating RBI regulatory directions. Regulated lenders and their fintech partners are barred from accessing mobile contact address books. If an app conditions loan approval on granting contact permissions, it is either an illegal predatory app or operating in direct breach of banking regulations.

Why do some apps ask for camera and location access?

The RBI allows strictly limited, purpose-specific one-time access to camera, microphone, and location solely for onboarding and customer verification. The camera and microphone are permitted for conducting live Video Customer Identification Process (V-CIP) or video-KYC, while location access confirms that the customer is physically present within Indian territory during onboarding.

Can an app retain my biometric data if I complete Aadhaar-based KYC?

No. Para 4.2 of the RBI Digital Lending Directions explicitly prohibits DLAs and LSPs from storing biometric data. All biometric authentication must be processed directly through UIDAI-authorised secure channels without saving fingerprints, iris scans, or facial maps on commercial lender servers.

Where can I complain if an app shared my contact details with recovery agents?

You should file an immediate complaint through the RBI Complaint Management System (cms.rbi.org.in) against the associated regulated entity (the bank or NBFC funding the loan). If the recovery agents use the contacts to threaten, extort, or defame you, file an immediate complaint at cybercrime.gov.in or call helpline 1930.

Can I demand that a lending app delete all my financial data after I close the loan?

Yes. Under the RBI Digital Lending Directions and the Digital Personal Data Protection Act 2023, borrowers have the right to revoke consent and request deletion of personal information. While lenders must retain statutory accounting and transaction audit trails for five years under the Prevention of Money Laundering Act (PMLA), all peripheral personal data, device metrics, and contact records must be erased upon account settlement.

• Legal vs Illegal Loan Apps
• How to Verify Regulated Lenders
• App Harassment and Where to Report
• Fees, Cooling-Off, and Disclosures