InfraVeritas360DPDPiq

DPDP Insights › Questions › What can our lending or banking app collect from a phone?

Only what you need, with explicit consent. RBI's Digital Lending Directions already bar access to contacts, files, media and call logs, and allow one-time access to camera, microphone or location for onboarding or KYC. DPDP adds a notice, the right to withdraw and the right to know what was collected.

What the law says

Section 6 needs consent limited to what is necessary. RBI's Digital Lending Directions, 2025 set specific limits.

• Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
• Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
• Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

1. List every permission the app asks for.
2. Remove permissions not needed.
3. Ask camera and location only at the KYC step.
4. Show the notice in the app before sign-up.
5. Check partner apps the same way.

Evidence to keep

• Permission list with reasons
• App store listing
• Partner app review

Common mistakes

• Contacts permission for 'reference checks'
• Third-party analytics SDKs collecting device data
• Partner apps not reviewed

From each seat

• CISO / Security head: Test the app for data leaks in logs and storage.
• CIO / IT head: Review SDKs too; they often collect more than the app.
• Legal & compliance: Align permission wording with RBI's directions.

What a good answer from management sounds like

“Our apps and partner apps ask only for need-based permissions, at the step they are needed.” Effort and time: Light to medium · 4 to 8 weeks.

Related questions

• What should our privacy notice say, and where must people see it?
• When do we need consent, and when can we rely on a legitimate use?
• What must a vendor contract say about personal data?