Debt recovery does not authorise public shaming, contact scraping or threats to family and colleagues.
Preserve evidence, identify the regulated lender and use the lender, RBI and law-enforcement routes without paying an impersonator.
Stop sharing OTP or remote access.
Loan agreement and lender identity.
Deleting the app before evidence capture.
RBI’s digital-lending framework restricts access to mobile resources and requires regulated entities to remain accountable for lending-service providers.
Recovery conduct is also subject to RBI instructions, fair-practice expectations and applicable criminal, consumer and privacy law.
Where intimidation, impersonation, malware or unauthorised contact access is involved, cybercrime reporting may be relevant.
| Area | What to establish | Operating rule |
|---|---|---|
| Lender | Legal name, app and loan account. | Verify independently. |
| Permission | Contacts, call logs, media and device access. | Revoke unnecessary access. |
| Conduct | Calls, messages, threats and disclosures. | Create chronology. |
| Escalation | Lender, grievance officer, RBI and police. | Retain IDs. |
A reliable control should connect the individual, data field, purpose, notice or sector disclosure, system, employee access, vendor access, retention rule and closure evidence. A policy statement that cannot be traced through this chain is difficult to operate.
Maintain a legal-timing matrix. Record the DPDP provision, phased commencement status, current IT Act or sectoral duty, business owner, system dependency and implementation deadline. Avoid one blanket label such as compliant or not compliant.
Build controls into technology and workflow. A written instruction cannot stop an SDK from collecting contacts, a campaign tool from re-importing suppressed users or an agent from downloading medical records unless the system enforces the decision.
Use proportionate verification. Weak checks can expose another person’s information; excessive checks create more Aadhaar, health, payroll or bank data that must be protected and deleted later.
Generate evidence during ordinary operations: versioned screens, event logs, access approvals, vendor tickets, complaint chronology, deletion reports, test recordings and management decisions.
Map the regulated entity, platform, lending-service provider, recovery agent and technology vendors separately. Borrower-facing branding should not obscure accountability.
Customer-support and collections processes should prohibit requests for passwords, PINs, OTPs and remote-control access, and should preserve complaint and permission evidence.
Select one real user or transaction journey and trace it from collection through sharing, access, retention, withdrawal, complaint or closure. Capture the evidence at each stage.
Test the control on production-like systems rather than screenshots alone. Review network traffic, event logs, suppression status, vendor responses, role access and deletion output.
Run an adverse scenario: the vendor is breached, the user is a child, the borrower alleges harassment, the employee leaves or the app permission is revoked. Record the response and gaps.
Compare public wording with actual behaviour. Product forms, call scripts, privacy notices, contracts, SDKs and support tools should tell the same story.
Assign a named owner, funded action and closure date to each gap. Retain the reason when management accepts residual risk or chooses a less intrusive alternative.
Start with the privacy, security, product or regulated-business owner and preserve system evidence before changing configuration or deleting records. Separate current sector and CERT-In obligations from future DPDP readiness.
For serious complaints, children’s data, financial harassment, medical exposure or suspected cybercrime, involve qualified legal, privacy, cyber, banking, insurance or healthcare specialists and use the applicable official channel.
Management should review recovery-vendor permissions, complaint trends, agent identities, call recordings and contact-access exceptions monthly. Any evidence of threats, impersonation, public disclosure or unauthorised device access should trigger immediate vendor suspension, borrower protection and formal investigation.