A loan app took my contacts and photos: your data rights, and how to act

Written and verified by the Grahak Mitra research team — an independent project documenting digital consumer self-help in India.

Last updated: 2026-07-11

If a loan app pulled in your contacts, photos, or gallery and is now using them against you — messaging the people in your phone, shaming you, or morphing your pictures — that misuse is illegal, and it is not your fault. Even if you did take the loan, no one is allowed to harvest your whole phone and turn it into a weapon. You have real rights over your own data, and there are concrete steps you can take right now: cut off the app's access, ask in writing for your data to be deleted, and report the misuse to the right places.

Take a breath first. Being shamed through your own contacts is designed to panic and isolate you. What was done to your data is the wrongdoing here — not the fact that you borrowed.

What your rights actually are

Two things are worth knowing plainly, before the steps. The specifics of each — the exact provisions, conditions, and any timelines — are set by the law and the regulator, so check the linked DPDP and RBI sources for the current detail rather than relying on a figure quoted second-hand.

• The lender was only ever allowed to collect what the loan needs. Under the RBI's Digital Lending Guidelines, a regulated lender may collect only the data required to give and service the loan — not your entire contact list, your photos, or your gallery. An app that demanded all of that took data it had no business taking.
• You have data-principal rights under the DPDP Act, 2023. As the person the data is about (a "data principal"), the Digital Personal Data Protection Act, 2023 gives you rights over your personal data held by others — including the ability to ask for your data to be corrected or erased, subject to the conditions the Act sets. The exact scope and process are in the Act; treat it as a right you can exercise, on the terms the law lays down.

The misuse itself — contacting or shaming your contacts, or making or sharing morphed or obscene images of you — is a separate and more serious matter: that can be a crime, and it is reportable to the police, whatever the state of the loan.

Your data rights and how to act — the checklist

1. Revoke the app's permissions now. In your phone's Settings, open the app's permissions and switch off its access to Contacts, Photos, Storage/Files, and anything else it does not need. This stops it from reaching for more. You can do this before or after uninstalling the app — either way, cut the access.
2. Ask the lender, in writing, to delete your data. Use the app's or lender's own grievance channel to send a written request to erase the personal data it collected, and to stop contacting your contacts. Put it in writing, keep a copy, and note the date — a written request is your record that you exercised your right.
3. Save the evidence of the misuse first. Before you block or delete anything, capture screenshots of messages sent to your contacts, any morphed images, the demands, and the numbers and app name involved. This record is what any complaint or police report rests on.
4. Report an illegal or abusive lending app to RBI Sachet (sachet.rbi.org.in), the RBI portal for unregistered or abusive lending apps and entities.
5. Report the misuse as a crime. If your contacts are being messaged to shame you, or your photos are being morphed or shared, that is a criminal matter — file at cybercrime.gov.in or call 1930, and go to your local police. See how to report to cybercrime.gov.in and 1930.
6. Tell someone you trust — and warn your contacts if you can. A short message to close contacts ("an app is misusing my data, please ignore anything sent in my name") takes away the shaming's power, and telling someone you trust means you are not carrying this alone.

What you can, and cannot, expect from a deletion request

Be clear-eyed about this: asking for your data to be deleted is a right to request, and a process — not a guaranteed instant wipe. Exercising your DPDP right puts your request on record and obliges the recipient to handle it on the terms the Act sets, but no one can promise your data vanishes from every system the moment you ask. That is exactly why you keep a copy of your written request, keep the evidence of the misuse, and report an abusive app rather than relying on the request alone. Your rights are real; the process takes the steps above to enforce.

Two more things worth knowing

Not sure the app was ever legitimate? Many data-harvesting apps are unregulated to begin with — see how to check if a loan app is legal. And if the misuse has tipped into threats, abuse, or shaming right now, go to what to do about loan-app harassment — the calm, ordered response for when it is happening to you.

You are not alone

Having your own contacts and photos turned against you is frightening, and the shame it is meant to cause is not yours to carry — the misuse is the wrongdoing, and it is not your fault. Reach out to someone you trust, keep your evidence, and use the official channels below. If you are in immediate danger, contact the police. This is reportable, and there are people and portals on your side.