One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
A client from Pune came to us in late February 2025 with a troubling discovery. Within less than ten minutes on the morning of 22 February 2025, two "Consumer Loan" hard enquiry alerts appeared on her CIBIL report — one from Bajaj Finserv and another from Aditya Birla Finance. She hadn't applied for any loan. She hadn't visited any branch. She hadn't touched any loan-eligibility portal. Nothing.
Through careful technical tracking using a unique email alias she maintained, she traced the leak back to her existing co-branded credit card account held with IndusInd Bank, linked to a lifestyle rewards programme she'd enrolled in around March 2024. Her data appeared to have been shared as a marketing lead with these two lenders without her knowledge or consent. When she raised a dispute with CIBIL, both lenders rejected it outright. One claimed it held her "consent" on record. The other asked her to physically visit a branch with KYC documents to prove she'd never applied — for a loan she'd never sought in the first place.
She'd already written to the Nodal Officers of both lenders and to IndusInd Bank before approaching us. Those letters went unanswered for over three weeks. When she consulted Advocate Sudhir Rao, the matter was approached with a structured strategy: simultaneous complaints before the RBI Ombudsman under the CMS portal, a formal complaint to the Reserve Bank of India citing violations of the Credit Information Companies (Regulation) Act, 2005, and a consumer complaint before the District Consumer Disputes Redressal Commission, Pune. The lenders, faced with formal regulatory scrutiny, moved quickly. The enquiries were flagged, corrective communications were issued to CIBIL, and compensation for the credit score damage was secured. The client had spent weeks on her own without result. The structured legal approach achieved resolution within a few weeks of engagement.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Document everything immediately. Save all CIBIL alert screenshots with timestamps, all email communications to and from the lenders, and every rejection notice you receive. These form the backbone of your complaint before the RBI Ombudsman and the Consumer Forum.
File with the RBI Ombudsman without delay: The RBI Integrated Ombudsman Scheme, 2021 covers unauthorised credit enquiries and data-sharing violations by regulated entities. File on the CMS portal (cms.rbi.org.in). Make sure your complaint to the bank's Nodal Officer is at least 30 days old before approaching the Ombudsman, or that you've received an unsatisfactory reply.
And here's the thing — this category of case sits at the intersection of banking regulation, data protection law, and consumer law. A general practitioner may not be fully familiar with the procedural requirements across all three forums at once. Frankly, advocates who regularly handle banking and consumer protection matters understand which forum to prioritise, how to structure evidence, and how to push for expedited action. That domain-specific experience tends to make a real difference in both speed and outcome.
Applicable Sections of Law
Several statutes apply directly to unauthorised CIBIL enquiries and unlawful sharing of consumer credit data:
- Credit Information Companies (Regulation) Act, 2005 — Section 22: Prohibits any credit institution from accessing or furnishing credit information except in accordance with the Act. Violations attract penalties and regulatory action by the RBI.
- Consumer Protection Act, 2019 — Section 2(9) and Section 35: Defines "deficiency in service" and empowers consumers to file complaints before the District Consumer Disputes Redressal Commission for service failures by financial institutions.
- Information Technology Act, 2000 — Section 43A: Imposes liability on a body corporate that fails to implement reasonable security practices resulting in wrongful loss or gain through disclosure of sensitive personal data.
- Reserve Bank of India Act, 1934 — Section 45L: Empowers the RBI to issue directions to non-banking financial companies regarding their conduct, including data handling practices.
Jurisdiction — Where to File the Case
Multiple forums. That's the short answer.
For consumer complaints under the Consumer Protection Act, 2019, the District Consumer Disputes Redressal Commission at the complainant's place of residence or where the cause of action arose has jurisdiction. For monetary claims below Rs. 50 lakh, the District Commission is the right starting point. The RBI Ombudsman has jurisdiction over complaints against all RBI-regulated entities regardless of the amount involved. Complaints under the Information Technology Act, 2000 may be filed before the Adjudicating Officer appointed under that Act, and High Courts retain writ jurisdiction for regulatory directions. Now, before you act, get jurisdiction right from the start — a technical dismissal on this point wastes months.
Limitation Period
Don't sleep on this.
Under the Limitation Act, 1963, a consumer complaint must ordinarily be filed within two years from the date on which the cause of action arose (Schedule, Article 24 of the Consumer Protection Act, 2019 read with Section 69). The cause of action here arises on the date the unauthorised enquiry appears or the date the lender's rejection is communicated. RBI Ombudsman complaints must be filed within one year from receipt of the bank's final reply or one year from the event if no reply is received. Missing these windows can be fatal to the complaint, though condonation of delay is available before Consumer Commissions on sufficient cause being shown.
Interim Reliefs Available
Before the Consumer Commission, a complainant may seek interim relief under Section 38(7) of the Consumer Protection Act, 2019, which empowers the Commission to issue interim orders to prevent irreparable harm. In appropriate cases, a direction to the Credit Information Company to flag the disputed enquiry pending adjudication can be sought. Before Civil Courts, temporary injunctions under Order 39 Rule 1 of the Code of Civil Procedure, 1908 restraining further data-sharing may be applied for. Make no mistake, interim reliefs matter significantly in credit-related disputes — every passing month with an unresolved hard enquiry continues to damage the credit score and borrowing capacity of the complainant, and that harm compounds quietly.
If You Are the Victim
- Obtain your full CIBIL report immediately and download the enquiry section with timestamps. This is your primary evidence.
- Write a formal complaint by registered post or email to the Grievance Officer of every NBFC or bank whose name appears in the enquiry, demanding a written explanation and correction within 15 days.
- File a complaint before the RBI Integrated Ombudsman on cms.rbi.org.in, attaching all correspondence, screenshots, and CIBIL report extracts.
- File a consumer complaint before the District Consumer Disputes Redressal Commission at your place of residence, claiming compensation for service deficiency, mental harassment, and credit score damage.
- If your data was clearly sold by a bank or fintech partner, file a separate complaint with the RBI's Department of Regulation citing breach of the Master Direction on Customer Service and data-sharing norms.
Documents You Must Keep Ready
- Aadhaar card and PAN card copies (identity proof)
- Full CIBIL report with the disputed enquiry section highlighted and timestamped
- Screenshots of CIBIL alert notifications on your mobile or email, with date and time clearly visible
- All written correspondence sent to the NBFC, bank, and CIBIL, with proof of delivery
- All rejection notices or replies received from the lenders regarding your dispute
- Bank account statements and credit card statements showing no transaction or application with the lenders in question
- Any email alias tracking evidence or technical logs proving the source of the data leak
- A copy of the terms and conditions of the account through which your data was allegedly shared
What Evidence Is Required?
- Primary evidence: The CIBIL report itself, showing the lender name, date and type of enquiry (hard enquiry), with timestamp — this is documentary evidence under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.
- Electronic records: CIBIL alert SMS or email notifications, screenshots with metadata, email trails with the lender, all admissible under Section 61 and Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.
- Negative evidence: Absence of any loan application, any signed consent form, or any interaction with the lender — supported by bank statements and email records.
- Correspondence records: Registered post or courier receipts confirming your written complaint reached the lender.
- Technical tracking evidence: Where available, email alias routing logs or similar technical proof tracing the data source to the originating institution.
How Courts Typically Approach Such Cases
Consumer Commissions have increasingly taken a serious view of financial institutions that abuse customer data. In cases like HDFC Bank Ltd. v. Arvind Kumar Srivastava before the National Consumer Disputes Redressal Commission, courts have held that a bank's failure to protect customer data and its resulting credit damage constitutes a clear deficiency in service. Commissions generally expect the lender to produce positive proof of the consumer's consent to the credit enquiry. And here's why that matters — if no signed consent form or verifiable digital consent trail is produced, the burden effectively shifts. Courts also routinely award compensation for mental harassment in addition to directing removal of the erroneous enquiry record.
Timeline of Legal Process
- Step 1 — Internal complaint to Nodal Officer: 15 to 30 days. This is a mandatory pre-condition before approaching the RBI Ombudsman.
- Step 2 — RBI Ombudsman complaint filing: 2 to 4 weeks for acknowledgment and case number assignment.
- Step 3 — RBI Ombudsman investigation and mediation: 30 to 90 days from filing, depending on the complexity and the lender's cooperation.
- Step 4 — Consumer Forum complaint filing: Can run parallel to the Ombudsman complaint. Admission and first hearing typically within 4 to 8 weeks.
- Step 5 — Written statements and evidence filing: 3 to 6 months, depending on the Commission's docket.
- Step 6 — Arguments and final order: 6 to 12 months from filing at the District Commission level, in most cases.
- Step 7 — Execution of order / appeal: If the opposite party defaults on compliance, execution proceedings take an additional 2 to 4 months.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Yes. And many lenders prefer it. Once a formal RBI Ombudsman complaint is registered, regulated entities face reputational and regulatory consequences, which creates genuine incentive for settlement. The RBI Ombudsman process itself includes a conciliation stage before adjudication. Parties may arrive at a settlement involving removal of the enquiry from the CIBIL record, a written apology, and monetary compensation for credit score damage and harassment.
Before the Consumer Forum, matters can be settled at any stage under Section 89 of the Code of Civil Procedure, 1908 or through the Forum's own mediation process. Lok Adalats are available for pre-litigation settlement as well. Settlement is usually advisable where the lender is willing to comply fully, including the CIBIL correction, because adjudicated orders sometimes take longer to execute.
Common Mistakes People Make
- Delaying action: Many people notice the enquiry, feel annoyed, and do nothing for weeks or months. The limitation clock runs from the date of the enquiry or the lender's rejection, not from when you finally decide to act.
- Relying solely on CIBIL's internal dispute process: CIBIL can only
Advocate Sudhir Rao, Supreme Court of India