An Indian mobile OEM operates a consumer registration app where customers create accounts post-purchase. At registration, the OEM offers Buy Now Pay Later / EMI financing via a partnered NBFC. The OEM collects name, mobile, email, address, PAN, and device diagnostics during registration. The NBFC needs KYC data (name, PAN, address, income proxy) for credit underwriting. A shared API is proposed to pre-fill the NBFC's onboarding form with OEM-collected data to reduce customer re-entry friction.

Who is the Data Fiduciary — the OEM, the NBFC, or both?

Both are independent Data Fiduciaries under §2(i) of the DPDP Act 2023. A Data Fiduciary is any person who "alone or in conjunction with others, determines the purpose and means of processing personal data." The OEM determines that it will collect device registration data and optionally financial data to offer EMI — that is a unilateral purpose-and-means decision, making it a Fiduciary. The NBFC independently determines that it needs KYC and credit data to underwrite a loan — it is also a Fiduciary for that purpose.

The key test is not "who collected first" but "who decided why and how." Since both entities independently decide the purpose of their respective processing, they are sequential Fiduciaries — not a Fiduciary-Processor relationship.

Can the OEM pass PII to the NBFC via API for faster onboarding — and under what conditions?

The OEM may pass PII to the NBFC only if all three of the following are satisfied:

1. Explicit, itemised consent at OEM onboarding. Under §6, the consent request must name the NBFC (or category of financial partners), list the specific data fields to be shared, and state the purpose (credit underwriting). A generic "we may share data with partners" clause is legally insufficient.

2. A separate, distinct consent at the EMI application step. If the customer consented to "device registration and warranty," that consent does not extend to financial data sharing. A distinct consent dialog must appear at or before the moment the customer clicks "Apply for EMI."

3. A Data Sharing Agreement (DSA) between OEM and NBFC documenting: categories of data shared, purpose, retention limits, the OEM's warranties of lawful collection, and the NBFC's obligations as a receiving Fiduciary.

The NBFC has mandatory RBI KYC obligations. Does this override the DPDP consent requirement?

No — but it creates a legal obligation basis that operates alongside (not instead of) the DPDP framework. Under §7(b), processing is lawful where it is "necessary for compliance with any law." RBI's KYC Master Direction mandates collection of name, address, PAN, and photograph from borrowers.

This means the NBFC does not need consent to collect and process KYC data it is legally mandated to collect directly from the data principal. However, the OEM still needs consent to transfer the data to the NBFC — because the OEM's original collection was for device registration, not NBFC KYC. The RBI obligation belongs to the NBFC, not to the OEM, and cannot be used by the OEM to justify its own data transfer.

If a customer withdraws consent with the OEM, what happens to data already at the NBFC?

Under §6(4), consent withdrawal must be "as easy as giving consent" and the DPDP Act requires the Fiduciary to cease processing upon withdrawal. However, §7(b) creates an important carveout: if the NBFC has already initiated a credit assessment or loan disbursement, its continuing processing is legally mandated (RBI obligations, AML, audit requirements) and is no longer consent-dependent.

The OEM's obligation on withdrawal: stop all future data transfers to the NBFC. The NBFC's obligation: retain only for the period mandated by RBI/PMLA regulations; delete thereafter. Data already transmitted and being processed under a legal obligation basis cannot be deleted merely because OEM consent was withdrawn.