Question: I noticed a hard inquiry on my credit report from a bank I never directly applied to, but I did sign up for a 'Buy Now Pay Later' (BNPL) app that partners with them. The bank says the app's Terms and Conditions gave them consent to pull my credit. Is it legal for a bank to access my bureau data without my direct, wet-ink signature?
Answer: Yes. Under the regulatory framework for digital lending and credit reporting, a regulated entity (bank or NBFC) can legally access your credit information if you provided explicit digital consent to their authorized Lending Service Provider (like a partnered BNPL app) during the digital onboarding process.

Supporting evidence:
title: rbi.org.in/NotificationUser.aspx
quote: REs shall ensure that any collection of data by their DLAs and DLAs of their LSPs is need-based and with prior and explicit consent of the borrower having audit trail
context: ith a LSP for digital lending, taking into account its technical abilities, data privacy policies and storage systems, fairness in conduct with borrowers and ability to comply with regulations and statutes. 9.2. REs shall carry out periodic review of the conduct of the LSPs engaged by them. 9.3. REs shall impart necessary guidance to LSPs acting as recovery agents to discharge their duties responsibly and ensure that they comply with the extant instructions 7 in this regard. B. Technology and Data Requirement

10. Collection, usage and sharing of data with third parties 10.1. REs shall ensure that any collection of data by their DLAs and DLAs of their LSPs is need-based and with prior and explicit consent of the borrower having audit trail. In any case, REs shall also ensure that DLAs desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions, etc. A one-time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/ KYC requirements only, with the explicit consent of the borrower. 10.2. The borrower shall be provided with an option to give or deny consent for use of specific data, restrict disclosure to third parties, data retention, revoke consent already granted to collect personal data and if required, make the app delete/ forget the data. 10.3. The purpose of obtaining borrowers’ consent needs to be disclosed at each stage of interface with the borrowers. 10.4. Explicit consent of the borrower shall be taken before sharing personal information with any third party, except for cases where such sharing is required as per statutory or regulatory requirement.

11. Storage of data 11.1. REs shall ensure that LSPs/DLAs engaged by them do not store personal information of borrowers except some basic minimal data ( viz., name, address, contact details of the customer, etc. ) that may be required to carry out their operations. Responsibility regarding data privacy and security of the customer’s personal information will be that of the RE. 11.2. REs shall ensure that clear policy guidelines regarding the storage of customer data including the type of data that can be stored, the length of time for which data can be stored, restrictions on the use of data, data destruction protocol, standards for handling security breach, etc. , are put in place and also disclosed by DLAs of the REs and of the LSP engaged by the RE prominently on their website and the ap