If you are running a regulated FinTech in India—an NBFC, a Digital Lending App (DLA), a Payment Aggregator, or a co-branded card platform—your compliance meetings have probably reached a deadlock over a seemingly unsolvable contradiction.
On one side, your data protection officer points to Section 8(7) of the Digital Personal Data Protection Act (DPDPA), 2023:
“A Data Fiduciary shall... erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and cause its Data Processor to erase any personal data...”
On the other side, your Chief Risk Officer and internal auditor wave the Reserve Bank of India (RBI) rulebook:
Under the Master Direction on KYC and Section 12 of the Prevention of Money Laundering Act (PMLA), regulated entities must preserve customer identification records and transaction ledgers for at least 5 years after the business relationship ends.
Cue the boardroom anxiety: “If an ex-borrower uninstalls our app and demands immediate erasure under DPDPA, what do we do? If we delete their data, the RBI can cancel our license. If we keep it, the Data Protection Board can slap a ₹250 crore penalty on us!”
Let’s put this confusion to rest. There is no contradiction once you understand the statutory carve-out and architect your systems around two distinct data vaults.
1. The "Unless" Clause: How the Law Protects Regulated Entities
Look closely at the opening words of Section 8(7). Many founders miss the opening qualification:
“A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force, — erase personal data...”
This is a definitive statutory carve-out. In Indian legal interpretation, specific statutory obligations override general privacy erasure rights.
If PMLA 2002, RBI’s Digital Lending Guidelines (DLG), the Income Tax Act, or Section 128 of the Companies Act require you to maintain records for 5 to 8 years, the DPDP Act does NOT force you to commit regulatory suicide by deleting them. The law acknowledges that financial stability and anti-money laundering controls take precedence over consumer erasure requests.
2. The Dangerous Trap: “We’re Regulated, So We Keep Everything Forever”
While the carve-out protects your regulatory records, many FinTech CEOs make a dangerous counter-assumption:
“Since our NBFC or partner bank reports to RBI, we can ignore Section 8(7) entirely and hoard every phone number, clickstream log, and dropped lead indefinitely in our data warehouse.”
This assumption is completely false and will attract maximum statutory enforcement.
The exemption applies only to the specific data points that sectoral laws require you to maintain. You cannot use an RBI license as a blanket shield to keep commercial marketing telemetry, abandoned loan leads, or device metadata.
| What You MUST Retain (RBI & PMLA Shield) | What You MUST Erase (DPDPA Section 8(7)) |
|---|---|
| KYC Files & Identification Dossiers: Aadhaar XML proofs, PAN verification logs, CKYC records (5 years post account closure). | App Telemetry & Device Scrapes: Wi-Fi BSSIDs, installed app lists, and location trails once underwriting/session finishes. |
| Transaction & Disbursement Ledgers: Loan disbursal UTRs, repayment schedules, EMI receipts, bank account validations. | Marketing Segments & Growth Profiles: User profiles synced to CleverTap, MoEngage, Meta Pixels, or Mixpanel for retargeting. |
| Forensic Audit Logs (Rule 8(3)): Traffic data and processing event logs (1-year mandatory minimum under DPDP Rules). | Abandoned Lead Data: Mobile numbers of users who dropped off on step 2 of your loan application without finishing KYC. |
| Formal Dispute & Fraud Records: Chargeback documentation and FIU Suspicious Transaction Reports (STRs). | Downstream Recovery Agency Lists: Borrower contacts stored on external tele-caller dialers once an NOC is issued. |
3. Three Real Scenarios That Will Trigger Penalties in India
Scenario A: The "Rejected Loan" Lead Hoarding Trap (Bengaluru BNPL App)
The Case: Rahul downloads an instant credit app, enters his mobile number and PAN, and uploads a selfie for a ₹30,000 personal loan. The underwriting engine scans his credit bureau file and rejects the application within 45 seconds.
The Old Practice: The growth team keeps Rahul’s contact details in their CRM forever. Every Tuesday, Rahul receives automated WhatsApp notifications: “Special pre-approved credit line waiting for you from our partner NBFC!”
The DPDPA Reality: The specified purpose was to evaluate an application for a specific loan. That purpose ended the second the application was formally declined. Unless RBI regulations specifically require retaining rejected applicant files for anti-fraud monitoring, hoarding Rahul's profile for secondary marketing violates Section 8(7).
Scenario B: The “Closed Account, Still Spammed” Disaster (Mumbai Neo-Bank)
The Case: Sneha opens a digital savings wallet. After six months, she closes the account and submits an account deletion request through the app.
The Compliance Action: The backend team moves Sneha’s KYC and transaction ledgers into cold storage for 5 years to comply with PMLA Section 12.
The Fatal Slip: Nobody purged Sneha’s record from the growth automation tools. Two months later, Sneha receives an email blast: “We miss you Sneha! Reopen your wallet this weekend and get ₹100 cashback!”
The Consequence: Sneha files a complaint with the Data Protection Board. The FinTech cannot claim an “RBI compliance defense” for marketing messages sent to an ex-customer whose purpose expired.
Scenario C: The Rogue Debt Collection Agency (Section 8(7)(b) Downstream Liability)
The Case: A digital lender shares a batch of overdue accounts with an outsourced tele-calling collection agency (a Data Processor).
The Resolution: The borrower pays all dues in full, and the lender issues an official No Objection Certificate (NOC). The loan is closed.
The Mandate: Under Section 8(7)(b), the lender must “cause its Data Processor to erase any personal data.” If the collection agency keeps the borrower's contact details on an unencrypted spreadsheet and calls them six months later for cross-selling or harassment, the parent FinTech bears direct statutory liability.
4. The Engineering Solution: The "Two-Vault" Architecture
You cannot solve this problem by asking your engineering team to manually review database rows. You need an architectural pattern that cleanly separates statutory data from commercial data.
[User Closes Account / Requests Deletion]
│
┌────────────────────┴────────────────────┐
▼ ▼
[VAULT 1: STATUTORY COLD ARCHIVE] [VAULT 2: LIVE COMMERCIAL STACK]
- KYC Dossiers (PMLA 5-Yr Mandate) - CRM & Marketing Automation
- Loan Ledgers & UTR Records - Push Notification Tokens & Pixels
- Immutable Audit Logs (DPDP Rule 8) - Analytics & Lead Generation DBs
│ │
▼ ▼
[Access: LOCKED / READ-ONLY] [Action: AUTOMATED HARD DELETE]
- Only for RBI/Tax Audit Inspections - Cascade Webhook to Data Processors
- Hard TTL Purge at Year 5 - Zero Commercial RetargetingHere is how modern FinTech engineering stacks implement this:
1. Isolate the "Statutory Cold Vault"
When an account is closed or a loan is fully settled, immediately revoke write access to the user's primary records. Export the statutory audit bundle (KYC pack, transaction ledgers, dispute filings) into an isolated, write-once-read-many (WORM) storage bucket (such as AWS S3 Glacier Vault Lock) with an immutable 5-year retention policy.
2. Trigger Automated Erasure in the Commercial Layer
Simultaneously fire an internal event: user.account.closed. This event must trigger an automated deletion job across your operational PostgreSQL databases, Redis session caches, and SaaS marketing stacks (CleverTap, Segment, Mixpanel).
3. Cascade Erasure Webhooks to Data Processors
To satisfy Section 8(7)(b), issue automated deletion webhooks to your third-party Loan Service Providers (LSPs), verification vendors, and recovery tele-callers (e.g., POST /api/v1/privacy/erasure-cascade) and require cryptographic or digital acknowledgment that records have been expunged.
Action Checklist for FinTech Founders & CTOs
Before the Data Protection Board begins scrutiny, conduct a fast 3-point internal audit:
- Map every data field to an explicit legal authority: If a field is not required by RBI, PMLA, SEBI, or the Companies Act, it belongs in your DPDPA erasure lifecycle.
- Audit your funnel drop-offs: Ensure that unfinished loan applications and declined leads have an automated Time-To-Live (TTL) that purges personal data within 30 to 90 days.
- Enforce Data Processing Addenda (DPAs): Update agreements with recovery agencies and KYC vendors to include automated deletion SLA clauses mandated by Section 8(7)(b).
You do not have to choose between RBI compliance and DPDP Act compliance. Respect the 5-year retention rules for regulatory data, and build clean, automated erasure pipelines for commercial data. Doing both protects your banking partnerships—and keeps your balance sheet safe from statutory penalties.