Compliance2 min read
Where borrower data actually sits, and why the answer has to be specific
In India means little on its own. The useful answer names the systems, the copies and the vendors, including the ones that only hold the data for four seconds.
Every collections vendor says the data stays in India. It is usually true of the database and frequently untrue of something else in the chain, because a modern collections stack is not one system. It is a database, an object store for recordings, a telephony provider, a messaging provider, a speech recognition service, a language model, a payment gateway and an Alternate MetaData vendor, and each of those is a place borrower data goes.
The map nobody has until they are asked for it
- Primary database: account, contact and history data.
- Object storage: recordings, transcripts, uploaded documents and field photographs.
- Telephony: the audio itself, in transit and often at rest for a retention period on the provider side.
- Messaging: the message body, which in collections contains a name and an amount.
- Speech and language services: fragments of conversation, sent for processing.
- Payments: identifiers, amounts and sometimes contact details.
- Tracing: whatever you send in the query, which is itself personal data.
Transient processing is still processing
The commonest gap is a service that holds data only momentarily and is therefore not thought of as storage. If a fragment of a borrower conversation crosses a border to be transcribed, that is a transfer, and it belongs on the map whether or not anything was retained. The honest version of a residency answer lists these; the marketing version does not mention them.
Sub-processors are part of your answer
Your vendors have vendors. A lender asking where the data sits is asking about the whole chain, and a partner who cannot name their sub-processors cannot answer the question. Keep the list current, publish it to clients, and commit to telling them before it changes. This is one of the least glamorous and most reassuring things a collections partner can do.
Choice beats assurance
The strongest position is not a promise about where a vendor sends data but the ability for the lender to choose the vendors themselves. Where a lender brings its own telephony, messaging and model credentials, the data goes where the lender has already approved, under contracts the lender already holds. It converts a question of trust into a question of configuration.
The one-page answer worth keeping ready
A single page listing each category of data, where it rests, which vendors process it, in which country, for how long, and under what contract. Every serious BFSI review asks for a version of this. Writing it once, and keeping it current, removes weeks from every subsequent one.