If nobody reviews old borrower data, your NBFC could be in trouble.
Imagine a folder full of old loan applications. Rejected ones. Closed accounts. PAN cards. Aadhaar copies. They are just sitting there. Nobody is checking them. Nobody is deleting them. Under the new DPDPA law, keeping data without a reason is not allowed. If something goes wrong — a leak, a complaint — you will have no answer. This applies to your NBFC today.
Your NBFC collects a lot of information. PAN cards. Aadhaar copies. Phone numbers. Salary slips. WhatsApp messages with customers. After a loan closes, RBI says keep records for 10 years. After that, a customer can ask you to delete their data. If you say no, you must write back with a reason. You also need a breach plan ready. Who calls whom if data leaks? Decide this now — not after a problem hits.
List all old loan files and mark which ones can be deleted now.
Write a simple 5-step plan for what to do if data leaks.
Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment
“Old borrower data is still live risk if nobody reviews it.”
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
