The model knows thingsthe customer was never told.

Alternative data is an edge only while it is a declared one.

In one line: Only if the purpose was clearly notified and the customer gave specific consent for it, and subject to RBI rules on app data access. Data collected for another purpose cannot be repurposed without a new basis.

The estate · Fintech & NBFCHover to inspect

A secret input is not a competitive advantage. It is a finding.

The scene

The credit model's best feature was the time of day customers charged their phones. It predicted default beautifully. The data came from an SDK installed for crash reporting. The privacy notice mentioned crash reporting.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
We collected it, so we can use it. Purpose is set at collection; a new use needs a new basis. Declare the scoring purpose in the notice, before collection.
It's anonymised inside the model. If it is linked to an applicant's decision, it is personal data in use. Treat model inputs as personal data and govern them as such.

Explaining a decision

DPDPA gives Data Principals the right to a summary of personal data processed and the processing activities. A lender that cannot say what fed a decision cannot answer that request.

Monday morning

  1. 01List every input to the credit model and its source.
  2. 02Match each source to the purpose declared at collection.
  3. 03Retire inputs with no matching purpose.

Questions, answered plainly

Can fintechs use SMS data for credit scoring under DPDPA?

Only if the purpose was clearly notified and the customer gave specific consent for it, and subject to RBI rules on app data access. Data collected for another purpose cannot be repurposed without a new basis.

Do customers have a right to know what data a lender used?

Section 11 gives Data Principals the right to obtain a summary of personal data being processed and the processing activities undertaken.

Sector · Fintech & NBFCYour onboarding takes ninety seconds. Your liability lasts years.Read → Fintech & NBFC · Deep divePermission is not consent. It is only access.Read → Fintech & NBFC · Deep diveThe consent model already exists. Copy it.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner