Industries · Banking and NBFCs
Loan data passes through many hands. Keep track of every one.
A personal loan application on an NBFC's app collects KYC documents, bank statements, a bureau pull and often device data in the first ten minutes. That data then moves to underwriting, a co-lending partner, a collections agency and the CRM. Each hand-off is a place where a purpose, a retention period or a consent withdrawal can get lost.
What you hold
The personal data in a typical week
The register every duty starts from. In TrustOS each category is linked to the systems that hold it, the purposes it serves and an owner.
Data register · Banking and NBFCs6 categories
- KYC documents, PAN and address proofs
- Bank statements and salary slips
- Credit bureau reports and scores
- Loan account, repayment and collections history
- Call recordings from sales and collections
- Device and location data from the lending app
Pressure points
Where the DPDP Act bites in banking and nbfcs
One tick for everything
Many apps ask for one tick that covers the loan, cross-sell offers and data sharing with partners. Under the DPDP Act each purpose needs to be clear, and a customer should be able to refuse marketing without losing the loan.
Retention that pulls two ways
RBI rules require some records to be kept for years after an account closes. The DPDP Act asks you to erase data once its purpose is served. You need a recorded reason for every category you keep, and a date when it goes.
Collections agencies and DSAs
Direct selling agents and recovery agencies hold customer phone numbers and loan details. You stay answerable for what they do with that data, so their contracts, access and deletion need checking.
A breach is a customer and regulator problem at once
A leaked bucket of bank statements means telling affected borrowers and the Data Protection Board, and possibly reporting to RBI and CERT-In as well, each on its own clock.
How TrustOS helps
The modules that matter most here
Map where application, bureau and collections data sits, from the loan origination system to the call recording server.
Record loan processing, cross-sell offers and partner sharing as separate consents, so a withdrawal for offers leaves the loan untouched.
Set retention per record type with the RBI requirement noted as the reason, and raise erasure tasks when the period ends.
Review each DSA, co-lending partner and collections agency, and track the contract gaps you find until they are closed.
Run one incident record with separate tasks and deadlines for borrowers, the Board and the other authorities you report to.
What it looks like in TrustOS · sample data
An example scenario
Illustrative example: a borrower withdraws marketing consent
A borrower with an active two-wheeler loan withdraws consent for offers in the Privacy Centre. In this hypothetical, TrustOS logs the withdrawal, sends tasks to stop SMS and WhatsApp campaigns in the CRM and the dialler, and leaves the loan account and its statutory records alone. The compliance team can later show when each system acted.
Rules that sit alongside the Act
- RBI directions on digital lending
- RBI Know Your Customer directions
- RBI guidelines on outsourcing of financial services
- Credit Information Companies (Regulation) Act, 2005
TrustOS helps you keep these obligations in the same record. Your counsel decides how they apply to you.
Watch the film
Lenders and NBFCs
Loan applications, KYC files and collections calls: the DPDP Act for lenders, and how TrustOS keeps the record.
For organisations · Lending
Lenders and NBFCs
Loan applications, KYC files and collections calls: the DPDP Act for lenders, and how TrustOS keeps the record.
Questions
From banking and nbfcs teams
Does the DPDP Act override RBI record keeping rules?
The Act lets you keep data where another law requires it. TrustOS records that reason against each record type, so a request to erase is answered with what goes, what stays and why. Your legal team decides how the rules apply to you.
Can TrustOS run inside our own data centre?
Yes. Many lenders prefer that, and TrustOS can be deployed inside infrastructure you control. A hosted option is also available.
We use a lending service provider. Who owns the compliance?
As the lender you will usually be the Data Fiduciary for the borrower's data. TrustOS lets you record each partner's role and the checks you have done, but the legal position is for your counsel to confirm.
For banking and nbfcs teams
See TrustOS run on banking and nbfcs data
Bring the systems that hold your KYC documents, PAN and address proofs, and the requests your team handles today. We will show the work moving through TrustOS, from the first request to the evidence.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.