How to Rely on the Loan Default Exemption Under Section 17(1)(f) of the DPDP Act
A lender that wants to find out what a defaulting borrower owns does not have to ask the borrower's permission. The loan default exemption in clause (f) of sub-section (1) of section 17 of the Digital Personal Data Protection Act, 2023 says so, and it says it in terms narrow enough that the limits matter as much as the permission.
Step 1: Fix the Commencement Position
Section 17 comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027, together with the obligations and rights that the exemption operates on.
Nothing turns on it today, which is why it is worth settling now. The exemption will be relied on by people working to recovery timetables, and a limb identified in advance is worth more than one identified during a default.
Step 2: Read the Clause
Clause (f) applies where the processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.
Four elements come out of that. A defined purpose. A person who has defaulted. A loan or advance from a financial institution. And a condition that the processing comply with disclosure provisions elsewhere. Each has to be satisfied, and the last is the one most often forgotten because it reads like a formality.
Step 3: Note What the Exemption Switches Off and What It Leaves On
Because clause (f) sits in sub-section (1), the effect is that Chapter II does not apply except for sub-sections (1) and (5) of section 8, Chapter III does not apply, and section 16 does not apply.
So consent is not required and the borrower's rights under Chapter III are not available against the processing. But two sub-sections of section 8 survive, and the obligations they impose are not displaced by the exemption. An advice that describes clause (f) as taking the processing outside the Act has overstated it.
Step 4: Apply the Imported Meaning of Default
The Explanation to the clause gives default the meaning assigned to it in clause (12) of section 3 of the Insolvency and Bankruptcy Code, 2016, which defines it as non-payment of debt where the whole or any part or instalment of the amount of debt has become due and payable and is not paid by the debtor or the corporate debtor.
Two things follow. The threshold is low: non-payment of any part or instalment is enough, so a single missed instalment engages the clause, which is what the Illustration printed under it describes. And the test is objective, turning on whether an amount that had become due and payable was not paid, rather than on any characterisation of the account.
Step 5: Apply the Imported Meaning of Financial Institution
The same Explanation gives financial institution the meaning assigned to it in clause (14) of section 3 of that Code, which covers a scheduled bank, a financial institution as defined in the Reserve Bank of India Act, 1934, a public financial institution as defined in the Companies Act, 2013, and such other institution as the Central Government may by notification specify.
That is a definition with four limbs, two of which are themselves cross-references to definitions in other statutes. So whether a particular lender is a financial institution for this purpose is a question to be worked out limb by limb, and a lender that is none of the four cannot rely on clause (f) at all, however ordinary its lending looks.
Step 6: Respect the Purpose Limitation
The permitted purpose is ascertaining financial information and assets and liabilities. That is an information gathering purpose and nothing wider. The clause does not authorise processing for recovery, for enforcement, for disclosure to third parties or for any other object.
Where processing is carried out for a different purpose, clause (f) is not the basis for it, and a separate basis has to be identified. Treating the clause as a general licence to process a defaulter's data is the error the drafting most invites.
Step 7: Satisfy the Condition About Other Laws
The clause is expressly subject to the processing being in accordance with the provisions regarding disclosure of information or data in any other law in force. The exemption therefore does not override whatever other statute governs disclosure of the information in question.
Identify those provisions before relying on the clause rather than afterwards. An exemption from this Act that is exercised in breach of a disclosure restriction elsewhere has not been validly exercised, because compliance with that restriction is written into the clause itself.
Step 8: Record the Default, the Purpose and the Basis
Record which amount became due and payable and was not paid, and on what date; which of the four limbs of the definition the lender falls within; the purpose for which the processing was carried out; and the other law whose disclosure provisions were considered.
Four short entries answer every element of the clause. Without them, the exemption is an assertion, and an assertion is what fails when the basis for processing is put in issue.
Common Pitfalls to Avoid
Reading the clause as taking the processing outside the Act: Sub-sections (1) and (5) of section 8 continue to apply.
Assuming a serious or classified default is needed: Default is non-payment of any part or instalment of an amount that has become due and payable.
Assuming any lender qualifies: Financial institution has a four limb definition and a lender outside all four cannot rely on the clause.
Using the clause for recovery: The permitted purpose is ascertaining financial information and assets and liabilities.
Sharing the results under the clause: It does not authorise disclosure to third parties.
Treating the condition about other laws as a formality: The clause is expressly subject to the disclosure provisions of any other law in force.
Relying on the clause for a borrower who has not defaulted: The clause operates on a person who has defaulted in payment due on a loan or advance.
Leaving the elements unrecorded: The amount, the date, the limb, the purpose and the other law are each part of the clause.
Key Statutory Provisions
Clause (f) of sub-section (1) of section 17 of the Digital Personal Data Protection Act, 2023: Processing for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.
Section 8 of the Act: General obligations of a Data Fiduciary. Sub-sections (1) and (5) survive a sub-section (1) exemption under section 17.
Section 16 of the Act: Processing of personal data outside India, which the exemption disapplies.
Section 3 of the Insolvency and Bankruptcy Code, 2016: Clause (12) defines default as non-payment of debt where the whole or any part or instalment has become due and payable and is not paid. Clause (14) defines financial institution as a scheduled bank, a financial institution as defined in the Reserve Bank of India Act, 1934, a public financial institution as defined in the Companies Act, 2013, and such other institution as the Central Government may notify. The Explanation to clause (f) imports both.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Places section 17, with Chapter II, Chapter III and section 16, in the group commencing eighteen months after publication.
Sources and References
Clause (f) of section 17(1), with its Explanation and Illustration
Section 17 of the Digital Personal Data Protection Act, 2023, bare text
The imported definitions, as published by the Insolvency and Bankruptcy Board of India
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapter IV
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments