DPDP Act (डिजिटल व्यक्तिगत डेटा संरक्षण अधिनियम, 2023)
The Digital Personal Data Protection Act, 2023 is India's data privacy law requiring apps to collect personal data only with informed consent, for stated purposes, and to let you access, correct and erase it. Combined with RBI's digital lending rules, a loan app must take need-based, purpose-limited data — and can never scrape your contacts, call logs or photo gallery.
Worked example
A loan app demanding contact-list access to "process your application" violates both RBI directions and DPDP principles. Deny the permission, and if the app blocks you for it, uninstall it and report it on Sachet.