1. What are the biggest legal and compliance challenges in managing an ecosystem that brings together OEMs, dealers, financiers, insurers, and farmers in the agritech sector?
The agritech sector operates in a complex ecosystem where farmers are the primary customers, making legal and compliance management particularly important in rural areas.
One of the biggest legal and compliance challenges is the multiplicity of regulators. OEMs, dealers, banks and NBFCs are governed by different regulatory authorities. For example, insurance-related activities involve IRDAI, while lending and procurement businesses are regulated by the RBI. Similarly, when dealing directly with consumers, consumer protection and e-commerce guidelines also become applicable. Managing these different regulatory requirements while working with multiple stakeholders is a significant challenge.
Another challenge arises from the platform’s role as a facilitator. While facilitating a tractor loan for an individual farmer, the platform serves as the point of contact between the customer and the bank. Similarly, in insurance, it facilitates the process between the bank and the customer, including the drafting of agreements. Since multiple stakeholders are involved, each functions under a different regulatory framework governed by authorities such as the RBI, IRDAI and others.
Liability allocation is another major challenge. Farmers from rural backgrounds are often unaware of the respective roles of OEMs, dealers, banks and NBFCs. Since they usually approach the platform first, they may not know whether the responsibility for a mis-sold machine lies with the OEM, the bank, the NBFC or the intermediary platform. Distinguishing the responsibilities of each stakeholder therefore becomes essential.
KYC-related requirements also present significant difficulties. Many farmers have limited literacy and may not possess the documentation required for secured loans. Guiding them through the process and completing the necessary formalities with limited documentation is therefore challenging.
Another important legal challenge is contract execution. Farmers from different states prefer contracts in their regional languages. For example, farmers in Rajasthan may prefer Hindi, while those in Maharashtra may prefer Marathi. Similar language preferences exist across the southern states. Preparing contracts in vernacular languages helps farmers understand the documents and safeguards their rights.
Compliance with consumer protection and e-commerce guidelines is another important requirement. As an intermediary platform, providing a grievance redressal mechanism is essential. Customer feedback is collected to understand whether the machine and the related services were satisfactory. Based on this feedback, services are facilitated between OEMs and customers, particularly in the tractors and rural equipment segment.
These are some of the legal and compliance challenges faced regularly. Efforts are continuously made to strengthen the platform through better service teams, regular customer interaction and continuous feedback collection. After-sales support is also provided. For example, if a farmer purchases a new tractor and later encounters a problem, the platform connects the customer with the relevant stakeholder to help resolve the issue. Even where customers are unable to obtain services directly, support is provided as a service provider.
These are the key ways in which legal and compliance challenges are addressed while operating between OEMs, dealers and banks within the agritech ecosystem.
2.What regulatory considerations become most critical for digital platforms that facilitate financing through NBFCs, banks and other financial institutions?
Among the various regulatory requirements, RBI compliance is the most critical for digital platforms facilitating financing through banks and NBFCs. Since the RBI regularly issues new regulatory guidelines, keeping pace with these evolving requirements remains one of the biggest compliance challenges.
The shift towards digital lending has significantly changed the financing process. Earlier, customers had to collect physical documents, visit banks and wait for approvals. Today, farmers can provide their details through a digital platform; the information is instantly shared with the credit bureau, and the bank processes the application. While this has made lending faster and more efficient, it also requires strict compliance with the RBI’s digital lending framework.
Data protection is another important consideration. Even before the DPDP framework, financial data protection was governed through the SPDI Rules and RBI guidelines. The RBI has consistently required that customers’ financial information must remain secure and should not be shared without their consent. As a result, digital lending platforms must ensure that customer data is collected, processed and shared only in accordance with applicable regulatory requirements.
The RBI’s Digital Lending Guidelines and Outsourcing Guidelines also play a significant role. These guidelines govern both NBFCs and fintech models. Where a platform facilitates digital loans as a Direct Selling Agent (DSA), it must first determine whether it qualifies as a Lending Service Provider (LSP). Even if the platform is not the lender itself, providing digital lending services brings it within the scope of the RBI’s LSP framework, making compliance with these guidelines mandatory.
Transparency regarding lending partners is equally important. The RBI requires all banks and NBFCs associated with the platform to be explicitly disclosed on the website. Customers should clearly know which regulated entities are providing the loans.
Obtaining explicit customer consent is another critical requirement. Since many customers are farmers, consent should be available in multiple languages so that they understand why their name, phone number and other personal information are being collected, how the information will be used, and that it will be shared with regulated entities such as banks and NBFCs for processing the loan application.
Although banks and NBFCs remain regulated entities, an LSP is also subject to RBI requirements. Therefore, many of the compliance obligations applicable to banks are also expected to be followed by the LSP while providing digital lending services.
The First Loss Default Guarantee (FLDG) framework is another important regulatory requirement. Where agreements exist between the platform and banks or NBFCs, the RBI has prescribed limits on such guarantees. These contractual arrangements must remain within the limits specified by the regulator.
Data flow and data retention are also closely regulated. Customer financial information may be collected only for the purpose of processing the loan application and sharing it with the bank. Once the loan is disbursed and a contractual relationship exists between the borrower and the regulated entity, the platform no longer has authority to retain or continue using that data. The customer relationship thereafter remains with the regulated entity.
However, certain compliance responsibilities continue even after the loan is disbursed. Certain records may still need to be preserved in secure cold storage because the RBI has the authority to inspect regulated entities as well as their Lending Service Providers and Direct Selling Agents.
The RBI’s inspection and audit rights must also be reflected in contractual arrangements. During the process of obtaining an NBFC licence, the RBI reviewed the DSA agreements and noted that the contracts did not expressly grant the regulator inspection and audit rights. As a result, the agreements were amended to incorporate these requirements. This illustrates that RBI oversight extends not only to banks and NBFCs but also to their Direct Selling Agents (DSAs) and Lending Service Providers (LSPs).
Recovery and collection activities are also governed by RBI guidelines. A platform cannot undertake recovery on behalf of a regulated entity without proper authorisation. Even where such authority exists, recovery must be carried out according to the RBI’s prescribed code of conduct. The RBI also introduced a detailed code of conduct for recovery activities, particularly following concerns that arose during the COVID-19 period regarding recovery practices. The code of conduct even prescribes standards relating to the appearance and conduct of recovery personnel to ensure professionalism during the recovery process.
Where multiple lenders are available on a platform, additional responsibilities arise under consumer protection laws. Since the RBI requires platforms to disclose all associated lenders, the platform must ensure that lenders are not promoted unfairly based on higher commissions. Giving preferential visibility to a lender because it offers greater commercial benefits could amount to a dark pattern. Therefore, compliance with the Consumer Protection Act and e-commerce guidelines is also necessary alongside RBI regulations.
Insurance-related services involve another layer of compliance. Although third-party insurance is mandatory, insurance products cannot be promoted directly unless the entity facilitating these services is registered as an insurance broker or a corporate agent under IRDAI regulations. To comply with this requirement, licensed insurance brokers are engaged to promote the insurance products. Without the appropriate licence, insurance products cannot be directly advertised or sold.
Regulatory compliance requires working with multiple regulated entities rather than relying on a single organisation. Since different activities are governed by different regulatory frameworks, specialised entities are engaged wherever required to fulfil the respective compliance obligations.
3.How should agritech companies prepare for DPDP compliance while delivering seamless digital services at the same time?
Before the Digital Personal Data Protection (DPDP) Act, data protection in India was primarily governed by the Information Technology Act, 2000, and the Sensitive Personal Data or Information (SPDI) Rules, 2011. During that period, the Ministry of Electronics and Information Technology (MeitY), through CERT-In, played a key role in handling cybersecurity incidents, issuing notices and addressing matters relating to data breaches and cross-border data flows. With the DPDP Act and the DPDP Rules now in place, compliance with the new framework is required by May 2027.
The DPDP framework is broadly similar to the GDPR, although it introduces concepts such as Data Fiduciaries and Data Processors. However, compliance for agritech companies presents different challenges because a significant part of their customer base is located in rural areas. While users in metropolitan cities are generally more aware of their rights, many people in rural areas are not. Therefore, creating awareness about the DPDP framework and the rights available to individuals becomes an important part of compliance before those rights can be effectively exercised.
For an agritech platform, the first step is to establish a clear consent architecture. Once personal data is provided on the platform, it may be shared with multiple stakeholders, including OEMs, insurance brokers, banks and NBFCs. Since the same information is shared with several entities, tracking consent becomes difficult. Accordingly, the consent required for each purpose should be identified and mapped. For example, an OEM may require only the customer’s name and contact details, whereas a bank or NBFC may require Aadhaar details, PAN details, credit score information and complete KYC documents. Consent should therefore be tracked according to the specific purpose for which the information is shared.
The next step is to determine what information actually needs to be collected. Collecting Aadhaar and PAN details at the initial stage may result in unnecessary concerns and complaints. Therefore, the platform limits the personal information it collects to the customer’s name and contact details wherever possible. Additional information such as Aadhaar, PAN and KYC documents is required by regulated entities such as banks, NBFCs and insurance brokers and not by the platform itself.
Where personal data is shared with vendors, the relationship is governed through Data Processing Agreements (DPAs). These agreements distinguish the roles of the Data Fiduciary and the Data Processor and define their respective responsibilities. Although the platform acts as the Data Fiduciary, the Data Processor is also expected to discharge similar responsibilities in protecting the data. Since penalties under the DPDP Act can be substantial, the agreements include indemnity provisions and allocate liability appropriately when personal data is shared with third parties.
Another important consideration is the possibility of being regarded as a Significant Data Fiduciary. Since the platform collects a large volume of farmers’ data, it could potentially be considered significant data, which may result in classification as a Significant Data Fiduciary and attract additional compliance requirements. At present, however, the Government has not prescribed any threshold for determining Significant Data Fiduciaries. Until such clarification is issued, the platform prefers to limit the collection of personal data in an effort to avoid falling within that category.
This approach differs from an earlier edtech platform that dealt with children’s data. In that situation, the nature of the data itself made it sensitive irrespective of whether it was collected on a large or small scale. In contrast, the present agritech platform deals with farmers’ data and therefore seeks to avoid unnecessary compliance obligations by limiting the amount of personal information collected.
Multiple policies are also required to make individuals aware of their rights, including the right to modify or erase their personal data. The platform allows users to request deletion or modification of their personal data through a single email or a one-click process. It has also developed, with the support of its IT team, a system that enables users to directly modify their personal data wherever permitted. Where deletion is requested, the data is moved to cold storage rather than being actively used because RBI requirements require certain records to be retained for ten years. Consequently, the data cannot always be permanently deleted. Since personal data is shared across multiple platforms, tracking that data continues to remain a significant practical challenge.
To further strengthen data protection, the platform uses data masking and data tokenisation. These measures are being implemented with the support of the IT team to minimise the impact of data breaches. Although complete protection is not possible, limiting the amount of data shared and masking or tokenising that information helps ensure that even if systems are compromised, hackers cannot easily access identifiable customer information. This approach also addresses situations where compromised accounts could result in customer information being exposed on the dark web. Since attackers generally attempt to obtain customer data during security breaches, data masking and tokenisation provide an additional layer of protection.
Along with the concept of a Data Protection Officer (DPO), the platform also maintains a grievance redressal mechanism through which individuals can raise concerns regarding their personal data. Where necessary, concerns are addressed directly or in coordination with dealers holding the relevant information. All complaints, communications and actions taken are maintained as records because record-keeping forms an essential part of compliance.
DPDP compliance is still evolving, and implementation continues alongside preparations for audit. Since the framework is new, practical understanding is also developing. Even Big Four firms and Tier-1 law firms are still building their understanding of the framework and generally advise that detailed audits will become more meaningful after implementation. Accordingly, compliance efforts continue while the DPDP framework gradually matures.
4.What compliance standards and safeguards are necessary to build trust in the agritech sector as it continues to grow?
The emergence of AI has brought a new era of digitalisation, with organisations increasingly relying on multiple AI applications to validate data and automate processes. As a result, trust has become a major concern for every organisation, not just one business. Maintaining transparency between customers, dealers and OEMs is therefore essential, and multiple compliance tools play an important role in supporting that transparency.
With AI validating data and handling many processes, human intervention has been significantly reduced. However, this also makes accountability more challenging. When most activities are automated, both within and outside the organisation, it becomes difficult to identify who is accountable for a particular action or decision.
At the same time, it is important to make customers comfortable with these changes. A large proportion of the customer base consists of farmers from rural areas who are not very familiar with AI and digital technologies. They still prefer having a person they can interact with and recognise, rather than relying entirely on technology.
To address this, customers are approached directly through a single-stop solution, where the vehicle and related services are provided through one point of contact. At the same time, a physical presence is being established across India. More than 100 centres are currently operational, with plans to expand this network to over 200 centres.
This physical presence helps create face value instead of relying only on interaction through digital platforms. Even from a personal perspective, dealing only with chatbots does not inspire the same level of confidence, as people continue to value human empathy.
Rather than creating only a digital footprint, the focus is on creating a physical presence across India. This helps build trust among customers, OEMs and dealers, including many dealers based in rural areas. Creating face value is equally important for them, as they also prefer human interaction over digital communication. For example, when contracts are shared digitally, they often respond by saying that they are not familiar with such processes and ask how they should sign the documents. As many of them are not familiar with corporate procedures, connecting with them directly is more effective than relying only on digital platforms or emails. This approach helps distinguish the business within the industry by creating trust through a strong physical presence rather than relying solely on digital interactions.
About Sachin Somani
Sachin Somani is the Legal Head at Tractor Junction, where he leads the company’s legal, regulatory, and corporate governance functions. With over eight years of experience, he specialises in corporate law, M&A, contract management, litigation, regulatory compliance, and strategic legal advisory, supporting business growth across technology-driven organisations.
Prior to joining Tractor Junction, Sachin served as Senior Legal Counsel at PW (PhysicsWallah) and held legal counsel roles at Intelegencia, Lawgical Associates, and Fides and Fiducia Law Firm. Throughout his career, he has advised on IPO readiness, investment structuring, financial transactions, labour law compliance, data privacy, and dispute resolution, working across the EdTech, FinTech, NBFC, and technology sectors.
Sachin holds a B.A. LL.B. from Bharati Vidyapeeth and is passionate about leveraging legal expertise to enable compliant, scalable, and business-focused growth.
Disclaimer: The opinions and views expressed in this article, including any accompanying data, are the sole responsibility of the author and should not be construed as reflecting the official policy or position of India Employer Forum.
