New Delhi: The Delhi High Court has sought a detailed response from the Reserve Bank of India (RBI) on a public interest litigation (PIL) alleging large-scale violations of borrowers’ privacy by non-banking financial companies (NBFCs) and their associated digital lending mobile applications. The court has asked the central bank to clarify what steps it has taken to enforce the Digital Lending Directions, 2025, issued to regulate the rapidly expanding digital credit ecosystem.
Hearing the matter, the court directed the RBI to file a counter-affidavit within six weeks. The affidavit is required not only to respond to the specific allegations raised in the petition, but also to place on record the overall enforcement action taken under the 2025 guidelines, including steps initiated against entities found to be in violation of the rules.
Certified Cyber Crime Investigator Course Launched by Centre for Police Technology
The PIL alleges that despite the issuance of statutory guidelines by the RBI, several digital lending applications available on Google Play Store and Apple App Store continue to access sensitive personal data of borrowers, including contact lists and call logs. The petitioner has claimed that these apps deploy coercive and opaque consent mechanisms, effectively forcing users to share personal data in violation of privacy norms.
In its observations, the court noted that the RBI had framed comprehensive guidelines to regulate digital lending activities in India. These guidelines aim to curb excessive data collection, ensure transparency in loan disbursal and recovery practices, and establish an effective grievance redressal mechanism for borrowers. However, the petition argues that these safeguards are not being implemented effectively on the ground.
According to the petition, the continued violations have resulted in a large-scale invasion of borrower privacy. It states that students, first-time borrowers, gig workers and economically vulnerable sections are disproportionately affected by such practices. The plea further argues that the unequal impact of these violations amounts to denial of equal protection under Article 14 of the Constitution, particularly for digitally dependent and economically weaker groups.
The petitioner informed the court that a formal complaint highlighting these violations had earlier been submitted to the RBI. However, no response was received and no remedial action followed. The petition contends that the RBI’s inaction has allowed non-compliant digital lenders to continue operating unchecked, constituting a failure to discharge the regulator’s statutory and constitutional responsibilities.
The PIL has been filed by a 22-year-old college student pursuing a degree in Political Science (Honours), who has sought urgent judicial intervention to prevent further misuse of personal data under the guise of digital lending. The petitioner has argued that unchecked access to personal data has also been used in some cases for harassment and coercive recovery practices, amplifying the harm to borrowers.
In addition to the RBI, the petition has named the Union Ministry of Finance, Google LLC and Apple India as respondents. It seeks directions to suspend or cancel the licences of NBFCs, digital lending applications and lending service providers found to be in violation of RBI norms. The plea also calls for accountability mechanisms to ensure that only registered and compliant entities are allowed to operate in the digital lending space.
A key demand in the petition is for the RBI to submit a detailed status report indicating the number of digital lending platforms found to be non-compliant so far, along with action taken reports against such entities. The petitioner has argued that transparency in enforcement is critical to restoring public trust in the digital credit system.
With regard to app marketplaces, the petition seeks directions for the suspension or delisting of all digital lending applications that are operating without RBI registration or are found to be violating the Digital Lending Directions, 2025. It contends that platform operators also bear responsibility in preventing unlawful financial apps from reaching consumers.
The court has listed the matter for further hearing on April 1. Legal observers note that the case raises significant questions around data protection, regulatory enforcement and consumer rights in India’s fast-growing digital lending sector. The outcome is expected to have wider implications for how financial regulators, technology platforms and digital lenders balance innovation with privacy and accountability.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
