Take your data back: the DPDP consent-withdrawal demand
A loan app that harvested your contact list or gallery got that access for onboarding — not for building a shaming machine. The DPDP Act 2023 lets you withdraw consent and demand erasure of data that servicing your loan does not require.
When this letter applies
- ▸The app accessed your contacts, photos or SMS and you now see that data being used for recovery pressure.
- ▸You have closed the loan and want your data deleted.
- ▸You want to cut off future misuse before it starts — withdrawal is preventive, not only reactive.
Who it goes to
The lender’s grievance officer and, where published, its Data Protection Officer / privacy contact. If the app names a separate technology company as its operator, address both — the regulated lender remains responsible.
What it must contain
- 1Identification of yourself and the account, plus the app whose data access you are addressing.
- 2The withdrawal, stated under DPDP Act 2023 §6: consent for processing your contacts, gallery, and any data beyond what loan servicing requires is withdrawn.
- 3The erasure demand: delete that data and confirm deletion in writing — including from any collection agency or third party it was shared with.
- 4The carve-out that keeps the letter credible: data genuinely required to service the loan (your own KYC, your own contact details) continues under its lawful basis — you are not trying to erase the loan.
- 5A response deadline (7 days is reasonable) and notice that non-compliance goes into your grievance record and, once operational, to the Data Protection Board.
The timeline
⏱️ 7 days demanded for confirmation. Withdrawal cannot be penalised — an app that responds by accelerating recovery pressure is compounding its violation, and that reaction itself belongs in your grievance letter.
What happens next
Screenshot the app’s permission screen and your withdrawal before sending — if contact-shaming continues after the withdrawal, the combination (withdrawn consent + continued use) is the sharpest data-protection evidence there is.
Don't draft it alone
Loan Kavach drafts this letter for your exact situation — personalised, legally worded, addressed to the right officer, dispatched from your email with the dates and deadlines tracked for you.
See how Loan Kavach works →⚖️ The legal basis for this page
Every step above rests on a specific law or RBI instrument. Cite these by name when you complain — a grievance that names its provision is handled differently from one that doesn't.
Consent-based processing must stop when consent is withdrawn; withdrawal is your unilateral right.
Lending apps’ data collection must be need-based with borrower consent — blanket contact-list harvesting fails that test on its face.
The constitutional privacy foundation underneath both statutes.
This is general legal information about public statutes and RBI instruments, not legal advice for your specific case.