Handling customer data and consent

This note sets out principles in plain words. The detailed obligations come from data-protection law and the RBI's current directions on outsourcing, digital lending and information security. Check them, or ask Compliance, before using data in a new way.

Principles

• Purpose. Use customer data only for the purpose the customer agreed to: assessing and servicing the loan. EWS signals from FASTag, GPS, e-way bills and the bureau are used under the consent taken at sanction.
• Minimum display. Screens show only what the user needs. Registration numbers and phone numbers are masked (OD 09 •• 4821, +91 98••• ••321). PAN, Aadhaar and full account numbers are never shown.
• Access. Staff see the cases they work on. Exports are logged.
• Third parties. Data shared with agencies or partners is limited to what the task needs, under a written agreement.
• Retention. Data is kept only as long as the law and our policy require.

In the app

The Co-Pilot reads the same masked data the screens show. It drafts; it never sends data outside the app.