Profiling and Risk Scoring
A credit score isn't an open resource. Any model deciding something about a person needs a defensible basis. It also needs a route to challenge it when it's wrong.
If you pull a credit score in India, you need a permissible purpose under the Credit Information Companies (Regulation) Act. Credit information is not an open resource. You cannot dip into it just because it would help underwriting.
Internal risk-scoring models are not exempt from that rule. Even if your model runs entirely on data you already hold, you still need a clear, defensible basis for using each field. You also need to be able to explain why the model makes the decisions it makes.
Am I a Data Fiduciary?
Automated decisions in finance carry DPDP obligations in addition to sector rules. Run the self-check to see how those apply to your product.
Run it nowUsers must also have a way to challenge decisions that are clearly wrong. Suppose a model quietly rejects an application. There is no reviewable trail. The customer has no way to raise their hand. Finance regulators will not accept that design for long.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
Consolidated text on India Code. Amendment currency not individually checked.