By sector

The DPDP Act, sector by sector.

What the Act actually asks of a startup, a fintech, a hospital, a school, an online store, a SaaS company, an HR team, a real estate firm, a CA practice, a law firm, a hotel or an agency. Same Act, different data, different first steps.

DPDP Act for startupsSector guide · Startups: Yes. The DPDP Act applies to any startup that processes digital personal data in India, from the first signup. The Central Government may exempt notified startups from a few obligations under Section 17(3), but not from consent, security safeguards, breach intimation or grievance redressal.
DPDP Act for fintechs and NBFCsSector guide · Fintech and NBFC: A fintech is a Data Fiduciary for every borrower, user and applicant, and the Act sits on top of RBI requirements rather than replacing them. The obligations that bite first are consent for each purpose, processor contracts with every partner in the lending chain, security safeguards under Rule 6, and the seventy-two hour breach report.
DPDP Act for hospitals, clinics and health appsSector guide · Healthcare: Every hospital, clinic, diagnostic lab and health app is a Data Fiduciary for its patients. Section 7 allows processing without consent in a medical emergency and for certain State health functions; everything else, including appointment booking, records, reminders and marketing, needs consent under Section 6 and a notice under Section 5.
DPDP Act for schools, colleges and edtechSector guide · Education: Education is the sector where Section 9 does the most work. A child is anyone under eighteen, so most students are children, and processing their data needs verifiable parental consent under Rule 10, with a ban on tracking, behavioural monitoring and targeted advertising directed at them. The Fourth Schedule exempts educational institutions from parts of Section 9 for the education itself, not for anything beyond it.
DPDP Act for e-commerce and D2C brandsSector guide · E-commerce and D2C: An online store processes personal data at every step: the browse, the cart, the checkout, the delivery and the marketing afterwards. The Act requires consent before tracking, a purpose-specific notice, contracts with the payment, logistics and marketing processors, erasure when the purpose ends, and a published grievance contact. Large platforms in the Third Schedule also face a fixed three-year retention clock.
DPDP Act for SaaS companiesSector guide · SaaS: A SaaS company wears two hats. For its own customers, prospects and website visitors it is a Data Fiduciary. For the personal data its customers put into the product it is a Data Processor, acting under Section 8(2) on the customer’s instructions. Both hats carry obligations, and the contract between them is the instrument that makes the second one work.
DPDP Act for HR and recruitmentSector guide · HR and recruitment: Section 7(i) lets an employer process employee data for employment purposes and to safeguard itself from loss without consent. That ground covers payroll, attendance and access control. It does not cover keeping a rejected candidate’s CV for years, sharing staff data with a benefits vendor without a contract, or monitoring that goes beyond the purpose.
DPDP Act for real estate developers and brokersSector guide · Real estate: Real estate runs on leads: site visit forms, portal enquiries, broker referrals and call-centre lists. Every one of those is personal data with a purpose attached. The Act requires consent for marketing beyond the enquiry, a notice that says who the lead is shared with, contracts with every portal and agency, and erasure once the enquiry is dead.
DPDP Act for chartered accountantsSector guide · Chartered accountants: A CA firm is a Data Fiduciary for its own clients and staff, and usually a Data Processor for the personal data inside a client engagement, such as an employee payroll or a customer ledger. Both roles carry duties. Beyond that, the Act creates a second line of work: every client the firm serves is itself a Data Fiduciary that needs the compliance done.
DPDP Act for law firmsSector guide · Law firms: A law firm is a Data Fiduciary for its clients, staff and website visitors, and a Data Processor for personal data inside a matter. Section 17(1)(a) exempts processing necessary to enforce a legal right or claim, which covers litigation files, but not the firm’s marketing site, its intake forms or its HR records. The Readiness Index found the firms that sell DPDP advice scoring 71 on their own websites.
DPDP Act for hotels and restaurantsSector guide · Hospitality: Hotels collect identity documents at check-in, restaurants collect phone numbers for tables and loyalty, and both run booking engines, Wi-Fi portals and marketing lists. Identity data collected under other laws has a legal retention period; everything collected for marketing needs consent, a purpose and an erasure date.
DPDP Act for marketing and advertising agenciesSector guide · Agencies: An agency running campaigns on a client’s data is a Data Processor for that client, and a Data Fiduciary for its own leads and staff. The Act reaches the tools agencies deploy on client sites: pixels, tag managers, retargeting and lead forms all process personal data, and the client answers for them under Section 8(1) while the agency answers under the contract.