Collections inherits its consent

Sources: the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified 13 November 2025), both as published in the Gazette of India.

The Digital Personal Data Protection Rules were notified on 13 November 2025, and unlike most of what lands on a compliance function's desk, they arrived with a clock. Rule 1 phases them explicitly: the institutional provisions took effect on publication, consent manager registration (Rule 4) follows one year later, and the substantive obligations — Rules 3 and 5 to 16, covering notice, security safeguards, breach reporting, retention, and the machinery for exercising borrower rights — commence eighteen months after publication, in May 2027.

That is not far away, and the work collections needs to do is mostly contractual and upstream rather than technical. Both take longer than building something.

DPDP has no legitimate interests clause

Anyone reasoning from GDPR will look for a legitimate-interests basis and not find one. DPDP offers consent, or one of the nine legitimate uses enumerated at Section 7(a) to (i). There is no general balancing test to fall back on.

It is worth reading that list rather than assuming what is on it, because debt recovery is not. The nine cover personal data the individual voluntarily provided for a specified purpose; the State providing subsidies, benefits, licences and permits; State functions and the security of the State; disclosure obligations imposed by law; compliance with a judgment, decree or order; medical emergencies; epidemics and threats to public health; disasters and breakdowns of public order; and employment purposes. Anyone trained on GDPR will recognise "debt recovery" and "enforcement of legal claims" as familiar legitimate-interest examples. They are not Section 7 categories.

Two of the nine touch collections at all. Section 7(a) covers personal data the borrower voluntarily provided for the specified purpose she provided it for — which simply returns the question to what purpose was specified, and where. Section 7(e) covers compliance with a judgment, decree or order, including orders relating to claims of a contractual or civil nature. That one is real, but it arrives only once you hold a decree. It does nothing for the ordinary pre-litigation contact that is almost the entirety of collections activity.

There is no legitimate use called debt recovery. For routine collections contact, the lawful basis is consent — or it is an argument.

Which is why this is an origination problem

The position available to a lender is therefore not a clever reading of Section 7. It is a Rule 3 notice, given at origination, that specifies recovery as a purpose in clear language with an itemised description of the data involved. Rule 3 also requires that notice to be presented and understandable independently of any other information the institution provides — which is a problem for the common practice of burying data-processing language inside the loan agreement.

That has an awkward consequence. The lawful basis your collections team will rely on in 2027 is being created right now by the origination team, in a document the collections team has probably never reviewed. If the notice does not contemplate recovery, contacting the borrower about their own overdue loan rests on a narrower and less certain footing — and no amount of downstream process fixes a notice that was never given.

For most lenders, the single highest-value DPDP exercise in collections is therefore to read the origination notice, for every product currently in the recovery book, and check whether recovery is actually in it.

Agencies are processors, and the paperwork usually isn't there

External recovery agencies generally sit as data processors, acting on the lender's behalf — though the classification turns on whether the agency independently determines purposes and means. That distinction is worth establishing deliberately rather than assuming.

Either way, responsibility for lawful notice and consent stays with the lender. Outsourcing the activity does not move the obligation. What is required is a data processing agreement carrying the Rule 6 security obligations, audit rights, and a defined route for approving sub-processors.

Rule 6 asks processors for real controls, not assurances:

• Encryption, obfuscation, masking, or virtual tokens mapped to the personal data
• Controls on access to the computer resources involved
• Visibility on access through logs, monitoring and review, to enable detection, investigation and remediation
• Logs and the personal data retained for one year, unless another law requires otherwise
• Measures for continued processing after a compromise, such as backups
• And — the one that matters most here — a provision in the contract with the processor requiring it to take reasonable security safeguards

That last item is not an implied obligation a lender can argue it has met in substance. Rule 6 asks for the clause to be in the contract.

Most agency contracts written before November 2025 contain none of this. Repapering a panel of agencies is slow work, involves commercial negotiation, and cannot be compressed into the final quarter before the deadline.

Borrower rights land differently in recovery

Data principals hold rights of access, correction and erasure, grievance redressal, and nomination. The first two carry a condition that matters a great deal here. Sections 11 and 12 attach in respect of a data fiduciary to whom the borrower has previously given consent — including data she voluntarily provided under Section 7(a). They do not straightforwardly follow where the lender is relying on one of the other Section 7 legitimate uses. Grievance redressal under Section 13 and nomination under Section 14 carry no such condition.

That gap is not a loophole worth planning around, because it points straight back at the origination notice. A lender on a consent footing takes on access and correction obligations and gets a defensible lawful basis for the whole recovery operation. A lender leaning on Section 7 to avoid those obligations services fewer requests and holds a narrower, more contestable basis for everything it does. In a book that generates complaints at the rate collections does, that is the wrong side of the trade.

Assume, then, that both apply. Correction gives a borrower a formal route to challenge the accuracy of the record being used to pursue them — DPD, outstanding amount, contact history. That request has to be handled operationally while collection activity is live, across whichever agencies and channels hold that data.

Grievance redressal applies whatever the lawful basis, and has to function even where the borrower's contact came from an agency rather than the lender. The institution has to be able to receive, trace and answer a complaint about an interaction it did not itself conduct — which requires the agency's contact record to be available to it in the first place.

Breach obligations are tighter than most collections stacks assume

Rule 7 sets a two-stage process for the Board. It receives an initial intimation without delay, describing the nature, extent, timing, location and likely impact of the breach. A fuller report follows within 72 hours of becoming aware — covering root cause, containment, prevention, and a summary of what affected individuals were told.

The borrower notification is easier to underestimate. Affected data principals must also be told without delay — not as soon as practicable, and not after the investigation concludes — in concise, clear and plain language, covering the nature, extent and timing of the breach, the consequences likely to arise for them, what is being done to mitigate it, what they can do to protect themselves, and the business contact details of someone who can actually answer their questions.

The clock starts on awareness, not on completing an investigation, and there is no size threshold below which the obligation lapses. The penalty ceilings behind this are substantial — up to ₹250 crore for failing to implement reasonable security safeguards where a breach follows, and up to ₹200 crore for failing to notify — two distinct entries in the Schedule, capable of arising from a single incident.

Those are ceilings, not tariffs. The Board imposes a penalty only where it determines the breach is significant, and Section 33(2) directs it to weigh the gravity and duration of the breach, the type of data involved, whether the conduct was repetitive, whether the institution gained or avoided loss, and — the operative one — whether it acted to mitigate the effects, and how promptly and effectively.

That last factor converts good record-keeping into money. An institution that can show, on the day, exactly whose data was in the affected system, on what basis it was held, and who was notified when, is arguing about a different number than one reconstructing it months later.

For collections specifically, note where borrower data physically sits: on agency laptops, in dialer systems, in call recordings, in spreadsheets emailed between offices. A breach in any of those is the lender's notification obligation, on the lender's clock.

What remains genuinely unresolved

One question does not have a settled answer yet: what happens when a borrower withdraws consent while recovery is ongoing.

Systems must be built to allow withdrawal and to enforce purpose limitation. But if recovery contact rests partly on a Section 7 legitimate use rather than on consent, it is not obvious that withdrawal terminates it — and the interaction between the two has not been tested. Anyone claiming certainty here is guessing.

The defensible posture is to record consent state and withdrawal accurately at account level regardless, so that whichever way the position settles, the institution can evidence what it knew and when. That is cheap to do now and impossible to reconstruct later.

The order of work

With roughly three quarters left before the substantive obligations commence, sequence matters more than effort:

• Read the origination notice for every product in the recovery book, and establish whether recovery is a specified purpose.
• Repaper agency contracts with Rule 6 security obligations, audit rights and sub-processor approval. This is the longest pole.
• Establish where borrower data actually resides across agencies, dialers, recordings and files — you cannot notify on a breach in a system you have not mapped.
• Make correction and grievance requests operable across every channel and partner, not just the ones the lender runs directly.
• Record consent basis, version and withdrawal at account level, and retain it as accountability evidence.

Collections attracts a higher density of customer complaints than most parts of a lending business. When the Data Protection Board begins hearing matters, it is a reasonable expectation that recovery practices will be among the earliest things it sees.