Policy ID: PCI/POL/25/2026-27 • Version 1.0 Owner: Privacy Responsible Officer / IT • Approver: Board of Directors Sources: PRIV, CF, KYC, TECH • Review: Annual / regulatory change
Purpose and application
Borrower, applicant, employee and vendor data; privacy laws apply according to commencement and scope.
1. Purpose and notice:- Collect only necessary information for lending, KYC, servicing, credit reporting, employment or lawful duties. Provide clear purpose, sharing and retention notices. Record consent where required; consent shall not be bundled with optional marketing.
2. Digital permissions:- Digital lending apps shall not access contacts, call logs, files/media or telephony functions. Necessary one-time camera/microphone/location access for onboarding/KYC requires explicit consent. Provide consent controls and deletion requests subject to legal retention.
3. Sharing and storage:- Share only for a lawful disclosed purpose with authorized service providers or mandatory authorities. Apply RBI India storage and permitted overseas-processing conditions for digital lending data. Restrict LSP data retention and prohibit sale of customer information.
4. Security and rights:- Use role-based access, encryption, logs and secure disposal. Verify identity for access/ correction/withdrawal requests; explain any legal retention exception. Respond to breaches through the incident plan and make legally required notifications.
5. Governance:- Maintain a data inventory, retention schedule, consent records and vendor agreements. Compliance shall check DPDP commencement/Rules and other applicable law before publishing the public notice. Review annually and after material data incidents.
Source codes are linked to the Reference Register. Read with the common implementation controls and relevant annexes. Applicable law and RBI Directions prevail.