One customer. One financial decision. Many systems and partners.

The enquiry arrives long before any account exists - a campaign click, an app install, a comparison-site lead, a DSA who already holds a photographed PAN card, a dealer, an employer tie-up, a call-centre callback or a branch walk-in. Within minutes the same person sits in a CRM, an attribution platform, a partner's portal and somebody's own phone.

Where control breaks: The documents live on somebody's own phone

DPDPASomeone asking what a loan would cost has not agreed to be marketed to for the next three years. Give a notice at the point the enquiry is taken, collect only what the enquiry needs, keep the partner who introduced them from keeping their own copy, and decide when a lead that never converted is deleted.

The customer registers: a mobile number, an OTP, a device bound to the account, and a permission dialogue asking for rather more than the account needs. A device fingerprint, an IP, an app inventory and often a location go to a device-intelligence vendor before any financial data has been given at all.

Where control breaks: The phone is asked for more than the account needs

DPDPASecurity signals and marketing signals are different purposes and should not travel together. Ask for the permissions the service genuinely needs and say what each one is for, keep device data out of profiling that has nothing to do with fraud, and make a permission withdrawable without the account breaking.

Everything collected so far is combined and judged. A fraud engine, a rules engine and a model produce a risk grade, an eligibility, a price, a limit or a block - and a reason code. A human may review it; often nothing does. The decision, the score and the model version are written to a log and, later, back into the training data.

Where control breaks: A machine decides, and the customer cannot see how

DPDPAThis is the point where data stops describing the person and starts deciding for them. Record what the model was for and which categories it read, keep a human able to review a material adverse decision, give a reason the customer can actually act on, let them correct a factual input, and keep a fraud suspicion clearly distinct from confirmed wrongdoing.

The file leaves. A routing engine sends the same application to several lenders, each of which makes its own decision and keeps its own copy; a payment business hands identity and transaction data to a partner bank and a network; an NBFC discloses to a co-lender, an insurer and a registry. Each recipient becomes a separate holder of the record.

Where control breaks: One application, several institutions, one customer who cannot name them

DPDPAThe customer generally cannot name everyone who now holds their file, and the ones who said no keep it too. Keep a register of who received what, send each recipient the minimum their decision needs rather than the whole application, be clear about which organisation is actually making the decision, and track deletion at the recipients who declined.

The everyday relationship: statements, EMI schedules and balances, a failed auto-debit, a foreclosure request, a chargeback, a complaint. A support agent opens a console that shows the whole account history, a call is recorded, a screenshot arrives on WhatsApp, and a note is typed about the customer.

Where control breaks: One question opens the entire account

DPDPAAn agent handling one question rarely needs the whole file to answer it. Scope the console to what the query needs, verify who is actually asking before disclosing anything, keep notes factual rather than judgemental, set a retention period for call recordings, and make sure a correction made here reaches the systems downstream.

The path when things go wrong, and it looks different in each model: a delinquency assigned to an agency with a dialler and a field app; a frozen wallet, a negative balance and an investigation; a branch collection team and a printed list of borrowers. In all three, the customer's details - and their family's - reach people outside the core systems.

Where control breaks: Recovery partners get the borrower's file — and their family's

DPDPAThis is where the most contact data travels to the least controlled places. Use managed systems rather than personal phones, send an agency the minimum it needs to make contact, keep alternate contacts and family members out of it unless there is a genuine reason, log every assignment and visit, revoke an agent's access the day they leave, and log every disclosure made to an authority.

Repayment behaviour, transaction history and spend categories become a customer-value band, a propensity score, a pre-approved offer, a cashback segment and an audience uploaded to an advertising platform - reaching the customer by SMS, push, WhatsApp, a call-centre campaign, a DSA follow-up list or a branch sales sheet.

Where control breaks: How they repay becomes how they are targeted

DPDPAA service message and a promotion are different things and need different choices. Keep one suppression list that every channel checks, be able to explain what a segment was built from, keep financial-distress and transaction-category signals out of advertising audiences, and make a withdrawal reach the partner and agency lists too, not just your own database.

Everything settles: the closed loan, the shut wallet, the branch's physical file, the data warehouse, the model-training set, the vendor and DSA copies, the backups - and the fullest file of all, belonging to the people who were refused and never became customers at all.

Where control breaks: The fullest files belong to the people you refused

DPDPARetention has to be decided per record, not per person. A ledger entry, a live account and a record another law requires you to hold have grounds to stay; a bank statement pulled for an application that was refused two years ago does not. Separate what must be kept from what has merely never been deleted, suppress cross-sell the day an account closes, and write down the copies you know you cannot reach.