Ketan Pandita
1 Nov 2026 6 min read
India's digital lending system has been undergoing a complete overhaul. Instead of relying on collateral, income verification, and subjective decision-making, the modern credit technology relies on automated, data-driven underwriting principles. Digital lending through fintech players and digital lenders leverages machine learning to make credit decisions within seconds based on alternative data points, including social media activity, payment history, and cell-phone habits.
While this invention implies enormous opportunities for financial inclusion and productivity, it also comes with a harmful and unnoticed systemic risk: algorithmic bias. AI models - especially the "black box" kind of algorithm embed socio-economic inequalities of the past into a system that would almost certainly solidify discrimination at the behest of math.
In this article, I have tried to contend that the current legal framework in India, namely, the Digital Personal Data Protection (DPDP) Act, 2023 and the Consumer Protection Act (CPA), 2019, has a dangerous regulatory blind spot. It does not have the provision of law for auditing, challenging and fixing algorithmic discrimination in digital lending, thus depriving marginalised consumers of an efficacious remedy.
The Anatomy of the Black Box: Where Technology Meets Economics:
Economically, credit markets require symmetry of information and correct prices for risk. However, machine learning models price risk by learning correlations in the data that can be historical (descriptive) rather than causal. If the training data captures some socio-economic bias (e.g., which postal codes or demographics are less penetrated by credit or have higher default rates), the model will penalize applicants with similar features.
The real hurdle is "black box" AI: Artificial intelligence, as opposed to human loan officers, who must describe the reasons they turn down applicants, neural networks simply issue a credit score based on weighted variables even the bank that employs them cannot interpret. As a result, the prospective borrower is denied a loan, charged a prejudicial interest rate, or both for reasons based on surrogates for caste, gender, or economic background, none of which the prospective borrower can understand.
This creates a profound socio-economic paradox: fintech promotes financial inclusion by expanding access, but its automated mechanics simultaneously redline vulnerable populations based on invisible, unchallengeable digital markers.
The Regulatory Void: Scrutinizing the DPDP Act, 2023
When evaluating the legal safeguards governing data processing in India, the primary legislative anchor is the Digital Personal Data Protection (DPDP) Act, 2023. While the DPDP Act establishes a comprehensive framework for processing personal data, it fundamentally fails to address the unique harms of automated decision-making (ADM) and algorithmic scoring.
The Absence of a Right to Explanation: Unlike the GDPR which offers a qualified right for data subjects to opt-out of decisions based solely on automated processing, one finds no such provisions for the DPDP Act (Section 22 of the GDPR). However under section 6 of the DPDP Act valid consent has to be free, specific, informed and unconditional. Therefore, when consent is extracted by slapping dense end-user license agreements in front of the process of alternative data in an application, consumers are provided with a hard “take-it-or-leave-it” choice, and they cannot reasonably consent to a process whose parameters are concealed by trade secret.
Deficiencies in "Significant Data Fiduciary" Obligations: 10 provisions impose additional obligations on Significant Data Fiduciaries (SDFs), such as creating the data protection officer role, conducting data protection impact assessments (DPIAs), and carrying out independent audits. But the assessment of a data fiduciary as an SDF would be defined on the basis of quantitative criteria regarding the amount of data processed and not based on the qualitative risk of harm of automation. A mid-size fintech lender using high-risk models on their credit-scoring platform could fall outside of the SDF eligibility criteria, resulting in no required algorithmic impact audits on their models.
Consumer Protection Realities: The Limits of the CPA, 2019
When algorithmic bias materializes as a concrete financial injury—such as an unjustified loan denial or inflated interest rates—affected individuals naturally look to consumer protection frameworks. Here too, statutory frameworks falter.
Product Liability vs. Algorithmic Service Defect: Chapter VI establishes extensive product liability laws for both manufacturers and service providers. Nevertheless, these provisions were written with physical goods and traditional service deficiencies in mind. Thus, it might be quite hard to make a case for a "deficiency in service," under Section 2(11), or a "product defect," under Section 2(34), when dealing with probabilistic AI systems.
The Burden of Proof Trap: Despite the current procedure, under consumer dispute resolution, the burden of proof is still on the consumer to establish negligence or deficiency. With respect to algorithmic disputes, as consumers will not have access to the source code, training data or weights in the system which fintechs will seek to maintain as their ‘know-how’ or trade secret, consumer commissions will remain institutionally incapable of disentangling technical bias in the absence of a statutory shift in the legal burden of proof or a mandatory algorithmic transparency.
Institutional Inertia and Regulatory Overlaps
In India, the jurisdiction over digital lending is fragmented. The Reserve Bank of India (RBI) has rolled out a set of Digital Lending Guidelines that have particularly progressive provisions such as on data storage, restrictions on shadow outsourcing and requirements to make disbursals to banks directly. However, it seems to be mostly concerned with monetary stability and banking sector health.
In addition, consumer forums do not appear to have the technical machinery to inspect such complex machine learning pipelines. Courts and quasi-judicial forums have held that digital credit disputes must be addressed as in contract law, with the assumption that the moment the consumer ticks "I Agree" the parties possess equal bargaining power. This institutional disconnect enables systemic discrimination to run unchecked behind the mask of technical complexity.
Constructive Path Forward: Towards Algorithmic Accountability
Critiquing existing laws is only productive if it yields actionable institutional reforms. To bridge the regulatory gap between innovation and justice, Indian regulatory policy must evolve through three targeted interventions:
Statutory Mandates for Algorithmic Transparency: It is proposed that AIAs be mandated by the Parliament or regulator like the Reserve Bank of India and the Data Protection Board of India, prior to a credit-scoring model's deployment. Additionally, lenders must be required to demonstrate that their models are subject to robust testing for disparate impact across these socio-economic groups.
Enacting a Right to Explanation: The Central Government should, in the exercise of its rule making powers under the DPDP Act, or through an amendment to it, explicitly provide data principals the right to access meaningful information regarding the reasoning that underpins automated credit decisions, in line with global standards.
Establishing Specialized Technical Adjudication: Consumer dispute redressal commissions and banking ombudsman frameworks must incorporate technical assessors or specialized digital arbitration panels capable of piercing corporate trade secrecy claims to evaluate underlying model bias.
Conclusion
Digital lending's legal, technological, and economic dynamics are well outside the scope of the regulatory controls available in the 20th century. Neglecting to address bias will entrench economic exclusion through the guise of algorithmic neutrality. India can, by bridging these statutory gaps in the DPDP Act and the Consumer Protection Act, nurture a fintech ecosystem that balances financial innovation with the constitutional tenets of equality.
Author: Ketan Pandita (Law Student)
Sign in to join the discussion.
In this article, I'll make the case that deterrence lives on more because it leaves a space around it than because the law calls for it. The true fault lies elsewhere: and that is the promise to disarm that is never enforced.
India has converted a sovereign treaty obligation into a private indemnity without a statute to carry it, and the seams show in three places: before international claimants, before Indian citizens, and inside the risk number on which the whole scheme rests.
