Data licensing for NBFCs and banks: what to ask for

NBFCs and banks are the largest buyers of bulk India company data, mostly for MSME underwriting. The market for this is opaque: vendors quote a single line-item price for "India company database", customers do not know what they are paying for. A practical checklist follows.

Coverage: ask for a coverage statement (% of MCA active companies, % of GST-active GSTINs, % of IEC holders, % of Udyam MSMEs). Vendors who cannot answer in numbers are reselling a partial dataset they did not source themselves.

Freshness: ask for the median age, in days, of the records, by source. A median above 90 days is stale. A median above 30 days is workable. A median below 14 days is excellent.

Provenance: ask for per-field provenance in the schema. If the schema is a flat firmographic file with no source attribution, you cannot defend the data in an audit.

DPA: insist on a Data Processing Agreement that specifies sub-processors, retention, breach notification, and DPDP rights handling. Many vendors will not have one.

Indemnity: ask for indemnity against DPDP-derived liability where the data sourcing was non-compliant. If the vendor refuses, that is a signal about sourcing.

Audit rights: ask for the right to audit the vendor's sourcing once a year. If the vendor is sourcing lawfully, this is a non-issue.

Refresh model: ask whether refreshes are pushed (delta files) or pulled (re-download). Push is cheaper to operate and easier to integrate.

Pricing model: ask for per-company-month pricing, not flat-fee. A flat fee disincentivizes the vendor from improving coverage. Per-company-month gives them an incentive to grow.

A vendor who answers these eight questions clearly is doing the job. A vendor who waves the questions away is not.