Tracing a PAN from a name and mobile number: legitimate use cases
Name plus mobile to PAN is powerful and easily misused. Here is where it is appropriate and how to stay on the right side of the line.
What the check does
Given a customer name and a registered mobile number, this lookup returns the PAN associated with that combination. It is useful when a customer cannot recall their PAN during a call, or when you are reconciling a payment against a known payer.
It is not a search tool for arbitrary people. The name and mobile must belong to someone you already have a relationship with and a lawful basis to check.
Appropriate scenarios
Collections and recovery teams use it to confirm they are speaking to the right borrower before discussing an account. Payment operations use it to attach a PAN to an inbound transfer for TDS. Re-KYC flows use it to pre-fill a form the customer then confirms.
In each case the person is already a customer, has consented to identity checks in the terms they accepted, and the check is proportionate to the task.
Where it crosses the line
Running the check on a prospect who has not consented, on an employee without an HR basis, or to build a profile of someone is a misuse of the data and likely a breach of the DPDP Act. Log the purpose of every such lookup and tie it to a case id.
If you cannot name the specific account, ticket, or application the check supports, do not run it.