Can a bank check my CIBIL report without my consent for an unsolicited loan offer?

Question

I received calls from a bank offering a pre-approved loan and later found they had accessed my credit report. Was this allowed without my consent? I would like to understand which provision governs this, what it entitles me to, and how long I have before the remedy lapses. I also want to know whether I need a lawyer for this or can do it myself.

MyVakeel Legal Desk · Accepted Answer

In India, the answer to "Can a bank check my CIBIL report without my consent for an unsolicited loan offer?" turns on Credit Information Companies (Regulation) Act 2005, Section 20 and RBI Master Direction on Credit Information Companies. The points below set out the position and then what to do about it, in the order it should be done.

Section 20 restricts credit information companies from providing credit information except to specified users such as banks, NBFCs and the borrower himself for a permissible purpose.

RBI's directions require credit institutions to obtain the customer's explicit consent before accessing his credit information report for any purpose, including pre-approved offers.

Unauthorised access or use of credit information without consent can be treated as a breach of the regulatory framework and reported to RBI for action against the credit institution.

Customers have the right to know which entities have accessed their credit report, since credit bureaus maintain an enquiry log visible in the credit report itself.

Complaints regarding unauthorised access can be raised with the credit information company as well as the RBI Ombudsman for deficiency in service.

What to do next: 1) Check the enquiry section of your credit report to identify unauthorised access by any institution; 2) Send a written complaint to the bank asking for the basis and consent record for accessing your report; 3) File a complaint with the credit information company regarding unauthorised access; 4) Escalate to the RBI if the bank cannot justify the access with valid consent.

If you are unsure whether your facts fall inside Credit Information Companies (Regulation) Act 2005, Section 20, that is worth checking with an advocate before you commit to a route, because switching later costs time. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in banking law.