The Credit Information Companies (Regulation) Act, 2005

What it does

The Act creates the legal basis for credit bureaus in India. A credit information company collects information about the borrowing and repayment record of individuals and businesses from lenders, holds it, and gives it back to lenders as a credit report or score. The Act says who may carry on that business, what they may collect, how they must protect it, and what the borrower may ask of them.

It does this by licensing. Only a company that the Reserve Bank of India has registered may carry on the business of credit information, and it does so under the Reserve Bank's supervision. The Act also gives the Reserve Bank power to issue directions, and that power is the footing on which a number of the Reserve Bank's wider directions on lending rest.

Who it binds

It binds three groups. The first is the credit information companies themselves, which must follow the privacy principles the Act and the regulations set, and which may be inspected and directed by the Reserve Bank. The second is the lenders, called credit institutions and specified users in the Act, banks and financial institutions among them, which must supply accurate information to a bureau of which they are members and may use reports only for permitted purposes. The third is the borrower, in whose favour the Act gives rights: to know what is held, and to have an inaccuracy corrected.

What has changed, and when

• The Act was passed in 2005 and works with rules and regulations made under it. The bureaus operating in India today are licensed by the Reserve Bank under it.
• The power in section 11 to issue directions to credit information companies and credit institutions has been cited by the Reserve Bank in later directions. The site's notes record that it is one of the sources of power for the Reserve Bank's Directions of 28 November 2025 on wilful defaulters and large defaulters, and for the digital lending directions issued on 8 May 2025.
• The way lenders report, and the way borrowers can see and challenge their data, has been tightened by Reserve Bank instruments over the years. Those instruments should be read for the date they apply from.

What turns on it in practice

For a lender, the Act is the reason that reporting is not optional and not casual. A borrower's default is reported to a bureau, and the report affects the borrower's access to credit for years. A lender that reports wrongly, or fails to correct a record after the borrower has shown it to be wrong, carries the exposure.

The site's note on the classification of wilful defaulters shows the Act at work from the other side. A classification is a serious consequence for a borrower and the Reserve Bank's Directions are issued in part under section 11 of this Act. Those Directions set a process of committees, a notice and a representation before a bank may classify a borrower, and a compromise lifts the label only when it is paid in full. A borrower facing a classification is therefore dealing with the lender's process under the Directions and with the data that flows to bureaus under this Act.

The same Act sits beneath digital lending. The site's note on digital lending records that the Reserve Bank's consolidated Directions on it cite section 11 of this Act among their sources of power. A lending service provider or a regulated entity that handles borrower data in a digital lending arrangement therefore has to ask what flows to a bureau, who reports it and who answers when the borrower disputes it.

For a borrower, the practical steps are to obtain the credit report, check the entries against the loan records and ask the lender, and if need be the bureau, to correct an error. For a lender, the steps are to reconcile the data submitted, keep the evidence of what was reported and when, and respond to disputes within the time the regulations allow.