India's digital lending industry has grown exponentially in the last decade. Now the industry allows consumers to borrow money from peer-to-peer lenders.

In India, the Aadhaar identity program was launched in 2009, allotting unique 12-digit identification numbers to billions of citizens. The Aadhaar adoption — coupled with the India Stack initiative, a set of application programming interfaces allowing entities to utilize digital infrastructure for presenceless, paperless and cashless service delivery — helps authenticate customers and speed up loan disbursement timelines. Moreover, the rise of digital lending platforms has been facilitated by the availability of customer data and the speed at which it can be accessed. This means lenders can offer more competitive rates and higher interest rates, despite having fewer resources than traditional banks. 

In the history of the organized credit industry, loan disbursement has never been this quick and seamless. Is it a fair trade-off to accept lightning-fast disbursals at high-interest funds in exchange for lack of transparency and security with respect to the financial identity of consumers? The answer is, perhaps, something simple: pace yourself.

Digital lending guidelines

The Reserve Bank of India has proactively aided consumers in pacing themselves. In September 2022, the RBI issued Digital Lending Guidelines. The guidelines aim to provide a regulatory framework for unregulated financial technology players, those at the intersection of the financial services and technology sectors, in the lender-borrower relationship. They impose strict data privacy standards, prohibit pass-through accounts, or third-party intermediaries, and require all loans to be reported to credit bureaus.

The guidelines went into effect 30 Nov. 2022, placing regulated entities, such as banks or non-banking financial companies that take loans off their own books, under an obligation to collaborate with fintech companies. As per the guidelines, fintech companies may not be able to assess a borrower's creditworthiness the same way they once could, as a result of restrictions on customer data collection and more. Note fintech compensates the RE to a certain extent if the borrower defaults.

Tackling data privacy concerns

Before enforcement went into effect, platforms exercised complete freedom to utilize customer data in evaluations of potential borrowers. By gaining access to a potential borrower's mobile device, they could gather data points such as location, phone book and media gallery for use in loan monitoring, recovery and credit underwriting. India's entire digital lending ecosystem was born from this unfettered use of customer data, allowing lenders to distribute uncollateralized loans by profiling their borrowers. This is also the tipping point for some platforms, as the lack of regulatory checks promoted privacy-wary practices.

The guidelines restrict the free flow of information between lenders and borrowers and mandate consent to process personal data. This may be a hindrance for stakeholders in the digital lending industry, as they depend on personal customer data, including their age and bank statements, to evaluate the borrower's spending trends, income status, repayment capabilities and creditworthiness. With a greater focus on operational transparency and data security, REs, digital lending apps and lending service providers (agents of REs) would be required to reanalyze their lending practices and creditworthiness assessment mechanisms.

The road not taken

Taking inspiration from Robert Frost's timeless wisdom, prudence demands DLAs, LSPs, and REs consider taking the road less traveled since that "shall make all the difference." Therefore, implementing the following controls could facilitate compliance with the data privacy and security measures entailed by the guidelines:

• Transparency: The DLA should provide customers with an easily accessible and clearly worded privacy notice. The privacy notice, at minimum, must convey the nature and purpose of the collected customer data, its storage location and timelines, details on third-party transfers and data security, along with the information of a nodal grievance officer if a complaint needs to be lodged. Privacy notices of pertinent REs and LSPs should also be provided to the customers.
• Nodal grievance officers: The RE shall ensure the LSP and DLA appoint a nodal grievance redressal officer to deal with fintech and digital lending related complaints and issues. Complaints should be resolved within 30 days, or customers could file a complaint through the Complaint Management System portal under the Reserve Bank-Integrated Ombudsman Scheme.
• Creditworthiness: REs are obligated to maintain records of the personal and financial data of customers prior to extending loans through the LSP and/or DLA. The data should not contribute to automated decision making concerning the increase or decrease of the credit limit without the borrower's explicit consent.
• Due diligence: REs must conduct due diligence before entering a partnership with an LSP for digital lending, considering its technical abilities, data privacy policies and data storage systems.
• Consent: Customers should be provided with an option to provide or deny explicit consent prior to their data being collected, and organizations ought to maintain records of such consent as well. Borrowers may exercise their choice at every stage of data collection with respect to the use, disclosure to third parties, retention and requests for deletion of their data.
• Data storage: REs must ensure the LSP and DLA only store the minimum customer information, e.g., name, address, and contact details, required to carry out their operations. They should not store biometric data. Additionally, customer data can only be stored on servers located in India.
• Data security: REs, along with LSPs and DLAs, are obligated to integrate technology standards and cybersecurity measures to protect customer data privacy. REs shall also ensure DLAs do not receive access to the customer's mobile phone resources like files, media, contact list, call logs and telephone functions. However, one-time access can be given to the camera, microphone or location for onboarding and know-your-customer requirements, subject to the borrower's explicit consent.

Getting started

The guidelines may be read in conjunction with the recently introduced Digital Data Protection Bill 2022. While the guidelines are a special law addressing a particular subject, its provisions prevail over a general law such as the DDPB. However, the baseline requirements of the DDPB, such as notice, consent, data transfer and rights of data principles, may be adopted by all fintech companies and initiate compliance with prescriptions under the guidelines.

Therefore, as a step in the right direction, digital lending entities and stakeholders should consider data minimization as an efficient risk mitigation strategy and avoid overt reliance on third parties in case customer data is heavily relied on for fulfilling business needs. Since automated decision making is a key feature of the digital lending ecosystem, only factually accurate customer data and profiles should be considered, subject to the explicit consent of the borrowers.