1. Legal Framework of Loan Assignment in India

RBI Master Direction on Transfer of Loan Exposures (MD-TLE) 2021, updated Sep 2024 + Digital Lending Directions 2025:

1. Assignment Structure: Standard assets can be assigned via novation or assignment deed. Lender shall be entitled, subject to applicable RBI directions on assignment/securitisation, to sell, assign, securitise or otherwise transfer its rights to any third party, with notice to borrower as required under law
2. Economic Interest: Minimum 10% retention for co-lending, 100% transfer allowed for direct assignment after Minimum Holding Period.
3. Borrower Rights: Borrower cannot be made worse off — interest rate, charges cannot be increased post-assignment without consent.
4. Data Flow: All loan disbursals and repayments must flow directly between bank/NBFC account and borrower's account — no pool accounts. This is to prevent data misuse

2. Data Protection Obligations in Assignment

When you assign a loan, you assign two things: Debt + Data. The debt assignment is governed by Transfer of Property Act + Contract Act. Data assignment is governed by DPDPA 2023 + IT Act + RBI Privacy Guidelines.

A. Under RBI Digital Lending Guidelines

• Purpose Disclosure: Purpose of obtaining borrower's consent needs to be disclosed at each stage
• Sharing with Third Parties: Explicit consent of borrower required before sharing any personal information with any third party, except where sharing is required as per statutory/regulatory requirement
• Storage Limitation: REs should ensure LSPs do not store personal information except some basic minimal data. Any collection must be need-based with prior explicit consent
• Localisation: Mandatory data localisation within India, explicit consent before sharing, no overseas transfer of borrower information

B. Under DPDPA 2023 vs GDPR

This is critical for fintech doing cross-border assignments:

DPDPA imposes additional obligations on data fiduciaries to flow down all required obligations contractually to data processors to ensure compliance

Therefore in loan assignment, original lender remains Data Fiduciary for data already collected, and assignee becomes new fiduciary. You need Article 28-type Data Processing Agreement.

3. Case Laws

1. Gstaad Hotels Pvt. Ltd. Vs. Union of India and Ors., Karnataka High Court
Landmark on loan assignment in India.

Held: Assignment of loan to a new entity by lender/bank need not be on express consent of borrower. Court would not sit as supervisor to banking activities except where violation of statutory provision. The underlying principle is that assignment need not be on express consent — knowledge to borrower would suffice

Impact: Simplified secondary loan market, but court added rider — strict compliance with statutory regulations and RBI guidelines, ensuring transparency and protecting borrower interests. So consent not needed for debt, but privacy compliance still needed.

2. IEHC 99 — Irish High Court (Permanent TSB / Start Mortgages)
Held: Notice of assignment of loans does not need to be sent in advance of demand for payment. Demand letter containing adequate information about assignment is sufficient to comply with Supreme Court of Judicature Act (Ireland) 1877. No need to expressly state associated security assigned[2022]

Used by Indian ARCs to argue post-facto notice is valid, but data protection notice must still be given before data transfer.

3. Borrower Privacy Rights — RBI Fair Practices Code
Moneycontrol explainer of borrower rights: Any information regarding loan or recovery has to be given out only with consent of borrower. No bank, regulated entity or recovery agent can misuse or violate borrower's privacy. Banks must ensure recovery agents are aware of privacy of customer information.

This was enforced in RBI's action against Paytm Payments Bank and multiple DLAs in 2023-24 where collection agents accessed contact lists.

4. Vidal-Hall v Google Inc EWCA Civ 311 (UK) + Lloyd v Google —
Established misuse of private information as tort for unlawful data transfer. Applied to loan assignments where borrower data sold to third-party debt buyers without consent.[2015]

5. Delhi High Court PIL on Digital Lending Apps (2023)
Court held that DPDPA permits processing only when consent is free, specific, informed, unconditional and unambiguous. Assignment to ARC without informing borrower violates this.

4. What You Must Do in Practice — Checklist for Assignment

Before Assignment:

1. Check loan agreement clause: Does it contain assignment clause? Most say Lender may assign with notice. If not, get borrower knowledge letter.
2. Data Audit: Identify Personal Data being transferred — KYC, CIBIL, income, contact, guarantor data.
3. Consent Layering:
   • For debt: Notice sufficient (Gstaad)
   • For data: Explicit consent required per RBI Digital Lending Guidelines if sharing beyond statutory requirement. Include in assignment notice: name of assignee, purpose, data categories, retention.
4. DPA between assignor and assignee: Purpose limitation, no onward sharing, security measures, breach notification within 6 hrs to CERT-In + 72 hrs to DPDPA Board, deletion after loan closure + 10-year RBI retention in archival vault.

After Assignment:

• Update CICs (CIBIL etc) with assignee name within 30 days per MD-TLE
• Allow borrower to exercise rights against new lender — access, correction
• No dark patterns — cannot use borrower data for cross-sell by assignee without fresh consent.

If You Are Borrower Whose Loan Was Assigned Without Data Consent:
You can invoke:

• Sec 43A IT Act + Rule 5 SPDI Rules — compensation for failure to protect sensitive personal data
• DPDPA Sec 12 — right to erasure / correction against new fiduciary
• RBI Ombudsman — violation of Fair Practices Code privacy