BFSI · Consulting, Technology
DPDP Act compliance programme for a lending NBFC, run on TrustOS
A DPDP Act readiness programme for a vehicle and MSME lending NBFC, covering data mapping, notices, consent, rights requests and breach response. The policies were written with the client's legal team and the day to day work now runs on TrustOS, with evidence kept for the Board.
- Client
- A mid sized NBFC in western India lending to two wheeler buyers and small businesses
- Region
- India
- Sponsor
- Chief compliance officer and the head of IT
- Duration
- 14 weeks to TrustOS going live, then a quarterly advisory review
Engagement model
O2E: Output Oriented Engagement
Each output was fixed and accepted on its own: the data inventory, the notice and consent design, the rights and breach procedures, and TrustOS live with branch staff trained.
How O2E worksThe team
- Privacy and compliance consultant1
- Business analyst1
- Integration engineer2
- Shared QA1
- Trainer for branch staff1
The challenge
Where things stood
- Customer data sat in the loan origination system, the collections app, a dealer onboarding portal, call recordings and branch file rooms, and no single list said where.
- Loan application forms carried one broad consent clause covering credit checks, marketing and sharing with partners.
- Requests to correct or delete data came through branches, email and the call centre, with no log and no clock running.
- There was no written procedure for a personal data breach, and the Board wanted evidence that the company was preparing for the May 2027 deadline.
The approach
How we ran it
Weeks 1 to 4
Assess and map
Interviewed each function, from sourcing and credit to collections and HR, and built a data inventory listing every personal data field, its purpose, where it is stored, who it is shared with and how long it is kept.
Weeks 4 to 7
Design notices and consent
Split the single consent clause into separate purposes, drafted notices in English, Hindi and Gujarati, and agreed with the legal team which processing relies on consent and which on a legitimate use under the Act.
Weeks 6 to 11
Configure TrustOS
Set up consent capture in the loan application and dealer portal, a rights request form on the website and WhatsApp, and connected TrustOS to the loan system so a withdrawal stops marketing use at the source.
Weeks 11 to 14
Breach drill and training
Wrote the breach response procedure, ran a tabletop drill with IT, legal and operations on a lost collections phone, and trained branch and call centre staff on taking rights requests.
What it looks like
Representative screens
Drawn to show the kind of system we delivered. Client screens and data stay private.
Incident INC-2026-007, collections phone reported lost
- Reported by
- Vikram Thakor, collections, Surat branch
- Reported on
- 18 Sep 2026, 10:42 am
- Data at risk
- Customer names, mobile numbers and EMI dues for 212 loan accounts
- Device status
- Remote wipe confirmed by IT
- Incident owner
- Kavita Menon, chief compliance officer
- Incident logged
- Device wiped and access revoked
- Risk assessment completed
- Notification decision with legal
- Closure report to the Board
What we delivered
Modules and features
- Personal data inventory and processing register across all systems and branches
- Purpose wise notices and consent text in English, Hindi and Gujarati
- Consent capture and withdrawal in the loan application and dealer onboarding flows
- Rights request intake on the website, WhatsApp and at branches, tracked to closure
- Breach response procedure with incident logging, assessment and notification steps
- Retention schedule for loan files, KYC records and call recordings
- Board report pack drawing on the audit evidence held in TrustOS
What changed
Outcomes
- The company has one current register of what personal data it holds, why and where
- Customers can give or withdraw consent for each purpose separately
- Every access, correction and erasure request is logged with an owner and a due date
- The Board reviews DPDP readiness from recorded evidence
Looking back
The data mapping took longer than the platform work, mostly because branch file rooms and call recordings were not on anyone's system diagram. Next time we would visit two branches in the first week, alongside the head office interviews. Splitting the consent clause caused more debate than expected, since sales worried about losing cross sell, and having the legal team in those meetings from the start would have shortened it. The tabletop drill was the most useful single day: it showed that nobody knew who could authorise a remote wipe, which was then written into the procedure.
Start a conversation
Discuss a similar project
Tell us where your team is today and we will walk you through how a project like this would run for you under O2E. The first conversation is free. Delivery work is paid only after you accept it.
A specialist replies within one working day. The first conversation is free.