- Home
- Industries
Industries
DPDP compliance by industry in India
The DPDP Act sets one set of duties for every Data Fiduciary. Each sector meets them through different data, partners and pressure points.
Short answer
The DPDP Act, 2023 and the DPDP Rules, 2025 apply the same core duties to every sector: notice and consent (s.5, s.6), security safeguards (s.8(5), Rule 6), breach intimation (Rule 7) and rights and grievances (Rule 14). Core obligations begin on 13 May 2027. What changes by sector is where personal data sits, who your processors are, and which extra rules apply, such as children's data (s.9) or Third Schedule erasure (Rule 8).
Industries
DPDP for fintech and NBFCs
DPDP for fintech and NBFCs: KYC and onboarding notices, app permissions, partners, Rule 7 breach response and your regulator's directions alongside.
IndustryDPDP for healthtech companies
Healthtech and DPDP: patient records, ABHA identifiers, labs and clinics as partners, consent, rights, retention and Rule 7 breach readiness.
IndustryDPDP for edtech
Edtech and DPDP: verifiable parental consent under s.9 and Rule 10, no tracking or targeted ads at children, and Rule 11 and Rule 12 read narrowly.
IndustryDPDP for e-commerce
E-commerce and DPDP: checkout and marketing consent kept apart, sellers and couriers as partners, rights at scale, and Rule 8 erasure for large platforms.
IndustryDPDP for SaaS startups
DPDP for Indian SaaS startups: processor for customers, fiduciary for your own users, sub-processor contracts and a lean plan for 13 May 2027.
IndustryDPDP for BPOs and GCCs
BPOs and GCCs under DPDP: processor or fiduciary roles, the s.17(1)(d) exemption for foreign clients' data, employee data and transfer notes.
IndustryDPDP for insurance
Insurance and DPDP: proposal and claims data, agents, brokers and TPAs as partners, retention against erasure, and Rule 7 breach readiness.
IndustryDPDP for banks
Banks and DPDP: legacy system discovery, notices to existing customers, breach and grievance at scale, and SDF readiness without assumptions.
IndustryDPDP for gaming and apps
Gaming apps and DPDP: under-18 players, parental consent, no targeted ads at children, ad SDK chains, telemetry limits and Rule 8 for large platforms.
IndustryDPDP for HR tech and employers
HR tech and employers under DPDP: candidate and employee data, the s.7(i) employment legitimate use and its limits, and payroll and ATS vendors.
IndustryDPDP for logistics
Logistics and DPDP: customer addresses and phones, rider data and live location, proof of delivery, partner fleets as processors, and retention.
IndustryDPDP for government contractors
Government contractors under DPDP: when the State is the fiduciary, s.7(b) and s.7(c), processor contracts under s.8(2), security and audit evidence.
Duties every sector shares
- A lawful ground for each purpose: consent (s.6) or a legitimate use (s.7).
- A notice that is understandable on its own, with itemised data and purposes (Rule 3).
- Security safeguards, including logs kept for one year (s.8(5), Rule 6).
- Breach intimation to affected people and the Board without delay, and a detailed report within 72 hours (Rule 7).
- Valid contracts with every Data Processor (s.8(2)) and erasure when the purpose ends (s.8(7)).
- A published contact (Rule 9) and a grievance response period of no more than 90 days (Rule 14(3)).
Where sectors feel extra pressure
| Pressure point | Where it bites | Provision |
|---|---|---|
| Children's data | Edtech, gaming | s.9, Rule 10, Rule 12 |
| Third Schedule erasure | Large e-commerce entities and online gaming intermediaries | Rule 8 |
| Employee and candidate data | HR tech and every employer | s.7(i) |
| Processing for clients outside India | BPOs and GCCs | s.17(1)(d) |
| Work done for the State | Government contractors | s.7(b), s.7(c), s.8(2) |
| Sector regulators | Fintech, banking, insurance, healthtech | Check your regulator's directions alongside DPDP |
Does the DPDP Act have separate rules for each industry?
No. The Act and Rules set one set of duties for all Data Fiduciaries. A few provisions bite harder in some sectors, such as s.9 for children's data and the Rule 8 Third Schedule for large e-commerce and gaming platforms.
Is my sector automatically a Significant Data Fiduciary?
No. The Central Government notifies Significant Data Fiduciaries under s.10, based on factors such as the volume and sensitivity of data and the risk to Data Principals' rights. No SDF has been designated that we know of.
Do sector regulators' rules still apply?
Yes. DPDP applies alongside them, so check your regulator's directions alongside DPDP. On transfers abroad, s.16(2) keeps stricter sectoral laws in force.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin