12 Nov 2026
The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 in a Gazette notification dated 13 November 2025 (announced by the Press Information Bureau on 14 November 2025). The Rules bring the DPDP Act, 2023 into operation in phases, over up to eighteen months. When you apply for a loan, this means you have clearer rights over the personal data you share, such as the right to give or withdraw consent and to ask for a correction. Your rights are set out in the Act and Rules, and a lender or platform must run a grievance system that responds within a reasonable period of not more than ninety days. The Press Information Bureau explainer dated 17 November 2025 is the source for this note.
What was notified, and when
Dates and facts from the PIB explainer
| Item | What it says |
|---|---|
| DPDP Act, 2023 | Enacted by Parliament on 11 August 2023 |
| DPDP Rules, 2025 | Gazette notification dated 13 November 2025 (announced 14 November 2025) after consultation that drew 6,915 inputs |
| Phased compliance | Rules 1, 2 and 17 to 21 (including the Board) started on notification; Rule 4 (consent managers) starts after one year; Rules 3, 5 to 16, 22 and 23 start after eighteen months |
| Data Protection Board | A fully digital Board of four members. Complaints can be filed online |
| Appeals | Appeals against the Board's decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) |
Eighteen months from the 13 November 2025 notification ends on 13 May 2027; the one-year mark for the consent manager rule is 13 November 2026. Some parts of the Rules can start earlier than others. The date each Rule starts is set in the Rules themselves. MeitY has discussed shortening some timelines, so check the notified text on MeitY before you rely on a particular date. Until a part starts, organisations are preparing their systems for it.
Key terms
- Data Principal: you, the person the data is about.
- Data Fiduciary: the organisation that decides why and how your data is used, such as a lender.
- Data Processor: an organisation that handles data on behalf of a Data Fiduciary.
- Consent Manager: a company in India that gives you one platform to give, manage, review or withdraw consent.
What the Act and Rules give you
The PIB explainer lists these rights and duties.
Your rights over personal data
| Right | What it means |
|---|---|
| Consent | You can allow or deny the use of your data. Consent must be clear, informed and easy to understand, and you can withdraw it at any time |
| Know | You can ask what data has been collected, why, and how it is used |
| Access | You can ask for a copy of the personal data a Data Fiduciary holds |
| Correct and update | You can ask for inaccurate or incomplete data to be corrected, or updated when your details change |
| Erasure | You can ask for data to be removed in certain situations |
| Nominate | You can choose someone else to exercise these rights for you |
| Breach notice | If a breach happens, the organisation must inform affected people without delay, in plain language, with contact details for help |
Every Data Fiduciary must issue a separate consent notice that is clear and explains the specific purpose for which your data is collected and used. It must also show clear contact information for queries about your personal data. Each Data Fiduciary must publish a grievance system that responds within a reasonable period not exceeding ninety days.
What this means for you when you apply for a loan
- Read the consent notice before you tick. It should say what data is taken, for what purpose, and who sees it. You can say no, though the lender may then be unable to process the application.
- Give only what the loan needs. A lender needs identity, address, income and bank details. It does not need access to your phone contacts.
- Withdraw consent when you no longer want a service. Withdrawal applies from then on. It does not undo what was lawfully done earlier, and lenders may need to keep records the law requires.
- Ask to see, correct or remove your data by writing to the organisation. Keep a copy of your request and note the date, because the response period can be up to ninety days.
- Look for the contact point for data queries on the lender's or platform's website. If it is not answered, you can complain to the Data Protection Board online.
- Keep your mobile number and email current with your lender, so breach notices and consent messages reach you.
How this fits with other loan rules
The DPDP rules sit alongside the RBI's rules for lenders. For example, the RBI's Digital Lending Directions already require need-based data collection with your prior and explicit consent. Our Your data page and privacy notice explain how LOANZ 360 handles your data, and you can make a request on the data request page.
Sources
- Press Information Bureau, DPDP Rules, 2025 Notified, 17 November 2025, pib.gov.in (link in the text above).
- Dates for individual Rules should be confirmed against the Rules notified by the Ministry of Electronics and Information Technology.
- This note summarises public rules in general terms. It is not legal advice.