DPDP Compliance by Industry

Hospitals, clinics, diagnostic labs and health-tech platforms handle some of the most sensitive personal data that exists — patient histories, diagnoses, prescriptions and health identifiers. While the DPDP Act doesn't create a separate legal category for "sensitive" data the way some other laws do, the practical stakes of a healthcare data breach are typically higher, which should shape how safeguards are prioritised.

Practical considerations:

• Map every system that touches patient data, including third-party lab and billing integrations.
• Pay particular attention to consent and notice at points of care, including for minors and dependents.
• Review contracts with diagnostic labs, insurers and billing vendors as Data Processor relationships.
• Build a breach response plan that accounts for the sensitivity and urgency involved in health data incidents.

Banks, NBFCs, payment platforms and fintech apps sit at the intersection of DPDP obligations and existing sector-specific regulation from the RBI and other financial regulators. KYC data, transaction histories and credit information are core to how these businesses operate, which makes data mapping and retention discipline especially important.

Practical considerations:

• Reconcile DPDP retention expectations with sector-specific record-keeping requirements, which may set longer minimum retention periods.
• Review how customer data is shared with credit bureaus, payment networks and lending partners.
• Ensure fraud-prevention and KYC processing has a clear, documented legal basis.
• Treat breach detection and reporting as a priority given the financial and reputational stakes involved.

Online retailers hold customer accounts, order history, delivery addresses, payment references and, often, detailed behavioural and browsing data used for personalisation and marketing. Consent for marketing communications and third-party data sharing (with logistics, payment and marketing partners) tend to be the areas that need the most attention.

Practical considerations:

• Separate consent for order fulfilment from consent for marketing and personalisation — don't bundle them.
• Review data sharing with delivery partners, payment gateways and marketing/analytics vendors as Data Processor relationships.
• Set clear retention periods for cart, browsing and behavioural data, not just order records.
• Make it as easy to opt out of marketing as it was to opt in.

Platforms that process data on behalf of business customers need clarity on which role they're playing in a given relationship — Data Fiduciary for their own operational data (billing, support tickets, product analytics), or Data Processor for the customer data their platform stores and processes on a client's behalf. Cross-border data flows are also a common consideration for globally hosted SaaS products.

Practical considerations:

• Clarify Data Fiduciary vs. Data Processor status for each category of data the platform handles.
• Reflect DPDP obligations in customer-facing data processing agreements (DPAs).
• Track where data is hosted and transferred, given the Act's restrictions on transfers to specific countries.
• Build data subject request handling into the product, not just into internal processes.

Schools, universities and edtech platforms handle student records, academic performance data, attendance, and — frequently — the personal data of children. That triggers the Act's verifiable parental consent requirements for children's data, and raises the bar on age-assurance and guardian consent flows.

Practical considerations:

• Build verifiable parental or guardian consent flows for any product likely to be used by children.
• Limit behavioural tracking and profiling of children's data, which the Act treats with particular caution.
• Review data sharing with ed-tech vendors, testing platforms and learning management systems.
• Set retention periods for student records that reflect academic and legal requirements, not indefinite storage.

Smaller organisations are still Data Fiduciaries the moment they process personal data — there's no size-based exemption in the Act itself. The advantage smaller teams have is being able to build compliant practices into their product and processes from day one, rather than retrofitting them later at greater cost.

Practical considerations:

• Start with a simple data inventory before the number of systems and vendors grows unmanageable.
• Design consent and notice flows correctly the first time, rather than bolting them on after launch.
• Keep vendor and processor contracts DPDP-aware from the first agreement signed.
• Revisit your compliance posture at each stage of growth, not just once at the start.

Every employer is a Data Fiduciary for candidate, employee and contractor data. The Act has a specific legitimate use for employment purposes, but it is limited to those purposes. Wellness programmes, intrusive monitoring and sharing data with partners for their own use still need a proper basis.

Practical considerations:

• Separate data needed for employment from optional uses that need free, specific consent.
• Set retention periods for unsuccessful candidates, active staff and ex-employees.
• Put written contracts in place with payroll, HRMS, insurance and background-check vendors.
• Write a monitoring policy and apply role-based access to HR systems.

Games, social networks and creator platforms have large, young user bases. Users under 18 are children, which brings parental consent and a ban on tracking and targeted ads aimed at them. Large platforms may also face dormant-account erasure and Significant Data Fiduciary duties.

Practical considerations:

• Decide whether you serve under-18s and build a working age gate.
• Switch off behavioural ads and tracking on child accounts.
• Build the dormant-account workflow with a 48-hour warning if the Third Schedule applies to you.
• Limit staff access to private messages and content.

Insurers, TPAs, brokers and insurtech platforms hold health, financial and family data. The Act sits alongside IRDAI rules, and the main practical work is mapping intermediaries, separating marketing from the policy journey and controlling claims data.

Practical considerations:

• Classify brokers, agents, TPAs and surveyors as fiduciaries or processors and paper each relationship.
• Keep marketing and cross-sell consent separate from proposals.
• Restrict access to claims and medical files.
• Set retention periods by record type.

Operators, ISPs and OTT platforms hold KYC documents, call records and location data. Licence and telecom law continue to apply. The Act adds notice, consent for non-mandated uses, security, breach reporting and user rights.

Practical considerations:

• Keep KYC data for compliance purposes only and secure resellers and franchisees.
• Treat location and traffic data as high-risk and restrict access.
• Keep a verified-request register for lawful disclosures.
• Run Board, telecom and CERT-In breach reporting together.

Airlines, hotels, travel agents and ride apps collect IDs, bookings and live location, and share data with many partners. Legal reporting to authorities, loyalty profiling and international flows are the main areas to plan.

Practical considerations:

• Name partners in the booking notice and get separate consent for partner offers.
• Collect only the ID data that law requires and keep it in controlled storage.
• Collect live location only while the trip needs it.
• Check cross-border flows and foreign vendors.

Agencies, ad-tech firms, publishers and lead-generation companies need a lawful basis they can show for every list and campaign. Purchased lists, cookies without consent and unclear agency-client roles are the main risks.

Practical considerations:

• Keep an auditable consent log and a working unsubscribe.
• Stop using lists you cannot back with consent.
• Sign data processing agreements between agencies and clients.
• Load ad tags only after consent and avoid targeting children.

Developers, brokers, portals and housing societies handle buyer KYC, leads, tenant documents and visitor records. Lead sharing, ID documents on phones and public notice-board lists are the common weak spots.

Practical considerations:

• Name lead recipients in enquiry forms and honour opt-outs everywhere.
• Move KYC documents out of phones and chat groups.
• Set retention periods for leads, tenancies and visitor logs.
• Notice and limit access for society CCTV and visitor apps.

Pharma, biotech, CROs and e-pharmacies handle trial, safety, patient-programme and doctor data. The research exemption is conditional, and sector laws on drugs and trials continue to apply.

Practical considerations:

• Align trial consent forms with DPDP notice requirements.
• Document which activities rely on the research exemption.
• Keep patient-programme data separate from sales systems.
• Sign agreements with CROs, sites and overseas sponsors.

Logistics, warehousing, manufacturing and gig platforms hold customer delivery data and data about the workers who move goods. Supply-chain roles, tracking, ratings and delivery-address exposure are the main issues.

Practical considerations:

• Map roles and contracts across shippers, carriers, 3PLs and platforms.
• Mask phone numbers and limit address exposure.
• Give workers a clear notice on tracking and ratings, and a route to challenge them.
• Set retention periods for proof-of-delivery and GPS data.