DPDPA audit NBFC readiness is a loan-file test, not a certificate hunt. Until the Central Government notifies you under Section 10 of the Digital Personal Data Protection Act, 2023, Rule 13 of the DPDP Rules, 2025 has not switched on.
TL;DR
- DPDPA audit NBFC work starts with one Gazette question: has this NBFC, or a class that includes it, been notified as a Significant Data Fiduciary (SDF)? If not, Rule 13 does not require an annual DPIA and statutory audit.
- Ordinary NBFC Data Fiduciaries still owe Sections 4–9 and 11–14 in full by 13 May 2027. Skipping baseline because “we are not an SDF” is the expensive miss.
- What survives a Board or examiner question is reconstructable Section 6 consent (burden under Section 6(10)), Section 8(2) processor contracts across LOS / LSP / collections, and one incident log that can feed CERT-In (6 hours) and the Data Protection Board of India (DPB) under Rule 7 (72 hours).
- A paid “DPDPA audit” before notification is not the Section 10(2)(b) independent data auditor. Software is not that person.
- Penalty ceilings sit in the Schedule: ₹250 crore for Section 8(5); ₹200 crore for Section 8(6); ₹150 crore for additional Section 10 SDF duties. The Board applies these on facts.
What does DPDPA audit NBFC work actually cover if you are not an SDF?
If no Section 10 notice has named you, DPDPA audit NBFC readiness is the Section 8 stack plus notice and ground — not Rule 13.
The lending stack is already in the Act. KYC, bureau pulls, LOS, LMS, CKYC, collections, DSAs and LSPs process digital personal data, so the NBFC is a Data Fiduciary under Section 2(i). Substantive duties under the DPDP Rules, 2025 (G.S.R. 846(E)) phase in on 13 May 2027. That clock is not the Rule 13 clock.
What you still owe, without being an SDF:
- Section 5 notices tied to the journey, in English or an Eighth Schedule language (Rule 3).
- Section 6 consent that is free, specific, informed, unconditional, unambiguous, by clear affirmative action — or a named Section 7 legitimate use. Employment-necessary staff processing can sit under Section 7(i); borrower marketing cannot hide there.
- Section 8(9) contact published, read with Rule 9, and Section 8(10) grievance redressal.
- Section 8(2) contracts with every processor; Rule 6 safeguards; Section 8(7) erasure when the purpose ends, subject to law in force.
The notification mechanics are in Significant Data Fiduciary under DPDPA. Dual-clock filings are in DPDPA compliance for NBFCs. This piece is what the compliance officer should refuse to buy, and what to build instead.
The DPDPA does not revive the old SPDI “sensitive personal data” category. Aadhaar KYC and bureau files are personal data under Section 2(t) — not a Rule 13 trigger because the file is “financial.”
Does RBI Scale-Based Regulation or an ISO pack trigger Rule 13?
No. Rule 13 follows a Section 10 notification. It is not an NBFC-sector default, not an SBR-layer default, and not an ISO-certificate default.
As at 25 September 2026, no Gazette notice has named any NBFC or class of NBFCs as an SDF. Until that notice exists you do not need an India-based Board-reporting DPO under Section 10(2)(a), and you do not need to appoint the statutory independent data auditor.
| Trigger people invent | What the Act actually does | What to write in the Board pack |
|---|---|---|
| ”We are NBFC-ICC / middle layer” | SBR is RBI. SDF is MeitY / Central Government | Last Gazette check date; status = not notified |
| ”We hold Aadhaar / bureau” | Sensitivity is a factor the Government may consider under Section 10 — not a self-score | Do not self-declare SDF |
| ”ISO / RBI IT audit done” | Parallel. Does not appoint the s.10(2)(b) auditor | Keep the RBI work; do not relabel it Rule 13 |
| ”Vendor sold us a DPDPA audit” | Not the statutory auditor before notification | Stop the PO unless and until notified |
RBI KYC, outsourcing and IT expectations continue in parallel. DPDPA did not repeal them. If counsel is relying on a specific RBI instrument number, put that number on the pack. This article does not invent a mapping circular.
What does a pre-notification “DPDPA audit” fail to prove on a named loan file?
It fails the first reconstruct question.
Pick one live account. Ask: which Section 5 notice version sat on that application, which purposes were granted or refused, which bureau ground, which LSP received the collections file, and when the rejected-applicant KYC was erased. If the answer is a shared drive and a policy PDF, you have narrative. A find-replaced DPIA template does not become Rule 13(2) because you paid for a logo.
After notification, people still sign the DPIA and the audit. Rule 13(3) algorithmic due diligence is a human duty on software you use, not a product you buy as the auditor. Keep the money for processor contracts, consent reconstructability, and a Saturday dual-clock drill. The runbook shape is in the NBFC breach SOP.
Which lending-stack artefacts replace the certificate before 13 May 2027?
A queryable system of record. Identifying data sealed and tokenised (aligned to Rule 6(1)), consent append-only, an audit trail an outsider can inspect. That is the Privigo platform argument for this cohort — and the financial solution cut. It is not a claim that software is your statutory auditor.
| Artefact | What “done” looks like on the stack | Owner |
|---|---|---|
| Purpose map | KYC, underwriting, servicing, collections, cross-sell — each with a Section 4 purpose and a Section 6 or Section 7 ground | Compliance + product |
| Notice versions | Timestamped text tied to the application or servicing event | Product / digital |
| Section 6 / 6(10) record | Who, when, which purposes, which notice, withdrawal if any | Product / eng |
| Section 8(2) pack | LOS, LMS, bureau, CKYC, cloud, LSP, DSA, collections | Legal |
| Rule 6 / s.8(5) | Access control and tokenisation of identifiers — not “the LMS has a password” | CISO |
| Dual-clock log | One register that can feed CERT-In 6h and Rule 7 72h | CISO + compliance |
| s.8(7) vs RBI KYC retention | Delete what RBI does not require; document the legal keep | Compliance + ops |
Stack-level consent flows still sit in consent across the NBFC/wealth stack. Processor data is still personal data. An LSP export does not leave the Act.
How should KYC retention under RBI sit next to Section 8(7)?
Document the collision; do not pretend one statute swallowed the other.
Section 8(7) wants erasure once the specified purpose is served, subject to law in force. RBI KYC retention is that kind of law for the classes it actually covers. Write the retention rule per record class. Delete rejected-applicant packs and marketing lists the KYC Direction does not freeze. Filing CERT-In does not discharge Section 8(6) / Rule 7, and an RBI incident note does not discharge CERT-In.
Cite the current RBI KYC Master Direction paragraph that applies to your NBFC class and product in the Board pack. Do not paste a generic keep-year from a vendor slide.
What should the compliance officer put in this month’s Board pack?
A status the MD can sign.
| Area | Owner | Status ☐ |
|---|---|---|
| SDF binary: last Gazette / MeitY Section 10 check date — not an SBR self-score | MD / compliance | ☐ |
| Published Section 8(9) contact (not titled DPO unless notified) | Compliance | ☐ |
| Purpose map: KYC, bureau, LOS, LMS, collections, LSPs | Product + compliance | ☐ |
| Section 8(2) contracts for every vendor on borrower data | Legal | ☐ |
| Reconstruct one live loan file (notice + consent + export) | Product / eng | ☐ |
| Dual-clock drill: CERT-In 6h + DPB 72h | CISO | ☐ |
| Do not buy a Rule 13 pack unless and until notified | Finance | ☐ |
If notification lands, add the India-based DPO, the independent data auditor, and the twelve-month DPIA and audit with a Rule 13(2) Board report — clock from the notice date. Build the evidence now; that is what either regime asks for.
Three moves, in order:
- Write the binary — “Notified SDF as of [date]: yes / no. Last Gazette check: [date].” One page in the Board pack.
- Reconstruct one loan file this fortnight — notice version, purposes, one processor export, erasure state for a reject. If you cannot, that is the gap, not the missing certificate.
- Run the dual clock on that file — 6 hours to CERT-In, 72 hours to the Board. Use the SOP you already have.
Book a 30-minute DPDPA discovery call →
Sources
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), MeitY — Sections 2, 4–10, 33 and the Schedule: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY — Rules 3, 6, 7, 9, 13, 15: https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
- DPDP Act commencement, G.S.R. 843(E), 13 November 2025, MeitY: https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf
- Press Information Bureau — Digital Personal Data Protection (DPDP) Rules, 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014
- CERT-In — Directions under section 70B(6) of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022: https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
This article is operational commentary for NBFC compliance officers, not legal advice and not a determination of whether any named NBFC is or will be a Significant Data Fiduciary. Confirm positions with qualified Indian counsel. RBI directions continue in parallel with the DPDPA.
FAQ
Does every NBFC need a Rule 13 audit under DPDPA?
No. Rule 13 of the DPDP Rules, 2025 applies only after the Central Government notifies you, or your class, as a Significant Data Fiduciary under Section 10. An ordinary NBFC Data Fiduciary still owes Sections 4 to 9 and 11 to 14 in full by 13 May 2027, but not a statutory annual DPIA and audit.
Does Aadhaar KYC or an RBI Scale-Based Regulation layer trigger Rule 13?
No. SDF status is a Gazette notification under Section 10. Aadhaar in the KYC file, NBFC-ICC or IFC classification, and asset size do not self-convert you. The DPDPA does not revive the old SPDI sensitive personal data category, so financial data is not a heavier audit tier by itself.
Can a vendor DPDPA audit certificate replace the independent data auditor?
No. After Section 10 notification, Section 10(2)(b) requires an independent data auditor as a person appointed to evaluate compliance. A pre-notification PDF, ISO slide, or software export is not that appointment and does not perform the Rule 13 DPIA.
When does the Rule 13 twelve-month clock start if our NBFC is notified?
From the date of the Section 10 notification. There is no grace period until 13 May 2027 and no pause until you buy a vendor pack. Until notification, do not title anyone DPO solely to look SDF-ready.
