Fintech Privacy: Navigating Indian and Global Frameworks

The global financial technology (fintech) sector, particularly digital lending, thrives on data, making robust privacy frameworks essential. As of October 2026, India’s data protection landscape, anchored by the Digital Personal Data Protection Act, 2023 (DPDPA), the DPDP Rules, 2025, and the Reserve Bank of India’s (RBI) Digital Lending Guidelines (DLG), provides a comprehensive domestic standard. This analysis compares India’s approach to the US Gramm-Leach-Bliley Act (GLBA) and the EU’s General Data Protection Regulation (GDPR) alongside the Payment Services Directive 2 (PSD2), highlighting key similarities and differences for an India-first audience.

Consent and Lawful Basis for Processing

India, through the DPDPA, establishes explicit, specific, informed, and unambiguous consent as the primary lawful basis for processing personal data (Section 6). The DPDP Rules, 2025 further detail the granularity required for such consent. For digital lending, the RBI DLG (para 3.2.1) reinforces this, mandating granular consent for accessing and storing specific data, explicitly prohibiting access to mobile resources like contact lists or photo galleries. The IT Rules, 2021 (Rule 5) also require consent for sensitive personal data.

In the EU, GDPR’s Article 6 (lawful bases) and Article 7 (conditions for consent) similarly demand clear, affirmative consent, with Article 9 imposing stricter conditions for special categories of data. PSD2 (Article 94) specifically requires explicit consent for Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs) to access payment account information.

Conversely, the US GLBA operates on an “opt-out” model for sharing Nonpublic Personal Information (NPI) with non-affiliated third parties (15 U.S.C. § 6802). Financial institutions must provide a clear notice and an opportunity for consumers to opt out. This approach is significantly looser than the explicit “opt-in” consent models prevalent in India and the EU, where consent is foundational.

Data Minimisation and Purpose Limitation

India’s DPDPA mandates that personal data processing must be for a lawful purpose and limited to what is necessary for that purpose (Section 5). The RBI DLG (para 3.2.2) provides concrete application for digital lenders, specifying that apps must collect only necessary data, maintain clear audit trails, and restrict access to device resources. This makes India’s stance particularly stringent for the digital lending sector.

The EU’s GDPR enshrines data minimisation (Article 5(1)(c)) and purpose limitation (Article 5(1)(b)) as core principles, requiring data to be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. PSD2 (Article 94) further limits Third-Party Providers (TPPs) to processing only data essential for the requested payment service.

GLBA, while requiring financial institutions to protect NPI, does not explicitly articulate data minimisation or purpose limitation as standalone statutory principles in the same way. While institutions are expected to collect data relevant to their services, the emphasis is more on safeguarding collected data and consumer opt-out rights rather than strict limits on initial collection. Consequently, India and the EU exhibit a stricter, more prescriptive approach to data minimisation compared to the US.

Data Security and Breach Notification

All three jurisdictions require robust data security. India’s DPDPA (Section 8) mandates reasonable security safeguards, complemented by the IT Rules, 2021 (Rule 8) for sensitive personal data. The RBI DLG (para 3.2.3) specifically requires digital lenders to implement robust data security measures, including encryption for data in transit and at rest, and to ensure data is stored securely. Breach reporting is governed by CERT-In guidelines under the IT Act.

GDPR’s Article 32 requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Articles 33 and 34 mandate breach notification to supervisory authorities and, in high-risk cases, to data subjects.

In the US, GLBA’s Safeguards Rule (16 CFR Part 314) requires financial institutions to develop and implement comprehensive information security programs. However, federal law under GLBA does not include a unified breach notification requirement; instead, this is largely governed by a patchwork of state laws, which can lead to compliance complexities. India and the EU offer more centralized and explicit breach notification frameworks.

Data Principal Rights: Erasure and Portability

The DPDPA grants data principals a Right to Erasure (Section 13) and a Right to Correction and Completion (Section 14). For digital lending, the RBI DLG (para 3.2.4) explicitly requires apps to provide an option for borrowers to delete their data. While not explicitly termed “data portability,” the spirit of data principal control aligns with this concept.

GDPR provides strong data subject rights, including the Right to Erasure (Article 17, “Right to be Forgotten”) and the Right to Data Portability (Article 20). PSD2 (Article 66) facilitates data access by TPPs with consent, indirectly supporting data portability within the payment ecosystem.

GLBA, in contrast, does not provide explicit federal rights to data erasure or data portability. Consumer rights under GLBA are primarily focused on the ability to opt out of certain data sharing practices and access to their own credit reports under related legislation like the Fair Credit Reporting Act (FCRA). This represents a significant area where Indian and EU laws offer stronger, more direct control to individuals over their data.

Practical takeaway

Indian businesses, particularly in the fintech and digital lending sectors, must understand that the DPDPA sets a broad privacy baseline, but the RBI DLG imposes sector-specific, often more stringent, obligations. Compared to the US GLBA, India’s regime, much like the GDPR, is fundamentally consent-centric, emphasizing affirmative opt-in and granting robust data principal rights such as erasure and purpose limitation. Compared to GDPR, the RBI DLG introduces highly prescriptive operational requirements for digital lending apps, particularly regarding data collection and storage on devices. Compliance requires a multi-layered strategy: adhering to DPDPA’s general principles, meticulously following RBI DLG’s granular rules for digital lending, and understanding global standards for cross-border data flows. Prioritize transparent, granular consent mechanisms, rigorous data minimisation practices, and clear, accessible data deletion options for users.