Does a loan app have to delete your data after the loan closes?
Reviewed by Confidential Dispatch Editorial Team · Updated 29 Oct 2026 · 5 min read
Yes, in principle. Once your loan is repaid and closed, the purpose your data was collected for is served, so under India’s DPDP Act the lender, whether a bank or a Non-Banking Financial Company (NBFC), must erase it. The exception is anything a specific law requires it to keep longer, such as accounting or dispute records. The Reserve Bank of India requires every digital lender to publish how long it keeps borrower data and how it destroys it, though no rule sets one number of days for every closed loan.
Educational resource only. This explains data retention and deletion for digital lending apps under the Reserve Bank of India’s rules and India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal or regulatory advice.
The situation
Your loan is closed, the final payment cleared months ago, and the app is still sitting on your phone with your KYC documents, income details and repayment history intact. Is that allowed once there’s no active loan left to service, or is the lender just holding onto it because nothing forces it to let go? Once the loan is closed and nothing is left to recover, it generally isn’t allowed.
Is there a fixed deletion deadline after closure?
No single fixed number of days applies across every lender
Unlike a bank’s KYC retention, which RBI ties to a specific multi-year figure, digital lending data doesn’t run on one universal countdown from closure. What governs it instead is the DPDP Act’s underlying principle: a lender, as your Data Fiduciary, must erase your personal data once the purpose it was collected for is served (Section 8), which for a loan is generally the point where it’s repaid and closed, with nothing left to service or recover.
What the lender is actually required to do
Two separate requirements point the same way: erase it once the loan is done, unless another rule still needs it
Under the DPDP Act, a lender must erase your data once it’s reasonable to assume the purpose is no longer being served, or once you withdraw consent, whichever comes first. Separately, RBI requires every regulated lender and the apps or service providers it works with to maintain a clear, written policy covering how long borrower data is stored and how it’s destroyed, rather than leaving retention to informal practice. Neither rule lets a closed loan’s data sit indefinitely with no stated reason.
What it can still legitimately hold onto
- A limited record kept for a real, ongoing reason, such as an unresolved dispute over the loan, a pending regulatory or tax requirement, or the statutory period within which a claim could still be raised against either side.
- Whatever a specific law names, for instance accounting or tax record-keeping requirements that outlast the loan itself.
- The full loan file kept indefinitely “for our records,” with no live dispute, legal requirement or purpose still being served.
How to ask for your data to be deleted
A direct request, made after closure, is the simplest way to start the clock on an answer
- Confirm the loan is fully closedIn the app or with the lender, not just paid down to zero with the account still technically open.
- Ask the lender in writing(an email, an in-app support request, or a formal grievance) to confirm what data it still holds and to erase what isn’t needed for a specific, ongoing reason.
- Ask for a specific answer, not a general oneIf the lender says it needs to retain something, ask what exactly, and for how long.
- Follow up if you don’t get a clear responseRather than assuming a lack of reply means it’s been handled.
What you can do about it
Push for a real answer, and escalate if the lender stonewalls your request
- Request erasure once your loan is closed and no dispute or legal requirement is outstanding.
- Ask for written confirmation once the lender says it’s been done, not just a verbal assurance.
- Escalate to the lender’s grievance officer, and from there to the Data Protection Board of India, if your request is refused or ignored.
FAQ
Can a loan app keep my data forever just by saying it’s “for our records”?
No. Once the loan is closed and no specific dispute or legal requirement remains, “for our records” isn’t a purpose that justifies continued retention under the DPDP Act.
Does RBI set an exact retention period, like it does for bank KYC records?
Not a single universal one for digital lending closure. RBI requires each lender to define and publish its own retention and destruction policy, rather than fixing one number for every case.
What if I still have another loan open with the same lender?
Data tied to an active loan is still serving its purpose, so erasure applies to the closed loan’s data, not to information the lender still needs for your open one.
Can the lender keep my data if there’s a dispute over the loan?
Yes, for as long as that specific dispute or legal process is ongoing, that’s a valid reason to retain the relevant records rather than a blanket excuse.
Does this apply to the lending app itself, or only the bank or NBFC behind it?
Both. The bank or NBFC is your Data Fiduciary and carries the primary erasure duty, and it must also ensure the app or service provider it works with erases the data on its instructions.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 29 October 2026 · Not legal advice.
