A DPDP readiness checklist for collections teams

Collections runs on personal data: phone numbers, addresses, employment details, family references. DPDP makes the lender a data fiduciary for all of it, including whatever sits in an agency's spreadsheets. The exposure is rarely the core system - it is the copies.

The checklist

• Can you list every system and vendor holding borrower personal data for collections?
• Is there a lawful purpose recorded for each category of data you process?
• Can you honour an erasure request without breaking your evidence obligations - and do you know where the line is?
• Are recordings and transcripts on a defined retention schedule, or kept forever by default?
• Do field officers' phones hold borrower data outside your control after sync?
• Are agency users individually identified, or does the agency share one login?
• Is do-not-call state honoured across every channel, or only in the dialer?
• Can you produce an access log for one borrower's record across a year?
• Do Alternate MetaData vendors process data under contract terms you could show a regulator?
• Is there a named grievance owner, and does the escalation path actually work?

The exposure is almost never the core system

Ask where borrower data lives and most teams name the loan management system. The honest answer is longer: the dialer, the recording store, the transcript index, the agency CRM, an Alternate MetaData vendor response cache, three analysts laptops, a WhatsApp group where a supervisor forwarded an address, and the export somebody made for a board pack in March. A data-flow map that stops at the systems with logins is not a map of your risk.

Erasure against evidence

The hardest question on the list is the third one, because two obligations point in opposite directions. A borrower can ask for data to be deleted. A regulator, or a court, can ask you to show what you did and when. These are reconcilable, but only if the distinction was designed rather than discovered during an incident: identifying details and the evidence of conduct are different categories, retained on different clocks, for different reasons. Decide which fields belong to which category before somebody asks, and write the reasoning down while it is still a calm decision.

Retention is a decision, not a default

Recordings and transcripts are the usual offenders, because storage is cheap and deleting things feels risky. Kept forever is still a retention policy, just an unexamined one, and it is the most expensive kind to defend. A schedule per data category, applied automatically, with the deletions themselves logged, turns an open-ended liability into a bounded one.

The agency chain

Work handed to an agency does not hand the obligation over with it. Two questions decide most of the exposure: are agency users individually identified, so that an access log names a person rather than a company, and does the agency keep its own copy of the book after the account is recalled. Shared logins and unreturned copies are the two failures that turn an agency relationship into your incident.

If you cannot answer these yet

Start with the inventory. Every other question on the list is unanswerable until you know where the data is, and most teams find that building the map removes more risk than the controls they were planning to buy, because it surfaces copies nobody had a reason to keep.

Teams that answer these from the system - rather than from a document written for the audit - spend less on both compliance and disputes. Retention, consent and access are cheapest when they are properties of the platform, not projects run against it.