The DPDP Act, sector by sector

The Act applies the same duties to every business. What you collect, who you share it with and where it goes wrong differs a great deal. Each guide covers its sector’s data, flows, vendors, risks and evidence, with a worked example of who is the Data Principal, Fiduciary and Processor, and leads to an assessment written for that sector.

• DPDP for fintech

  Lending, payments, wealth and insurance platforms. Covers KYC records, app permissions, partner lenders and recovery agents.

  Particular to this sector: Regulators decide what to keep; the Act decides how to handle it

• DPDP for SaaS

  Software sold to other businesses. Covers acting on a customer's behalf, sub-processors, hosting locations and tenant access.

  Particular to this sector: Fiduciary or processor depends on the data, not the company

• DPDP for healthcare providers

  Clinics, hospitals, labs, pharmacies and telemedicine. Covers patient records, report sharing, staff access and guardians.

  Particular to this sector: Emergencies, patients who cannot consent, and records other rules require

• DPDP for schools, colleges and coaching

  Schools, colleges, coaching and education apps. Covers parental consent, learning platforms, marks and campus CCTV.

  Particular to this sector: Verifiable parental consent, and what may not be done at all

• DPDP for e-commerce and D2C brands

  Online stores, D2C brands and marketplace sellers. Covers marketing consent, tracking, couriers, payments and account deletion.

  Particular to this sector: The order, the marketing list and the tags on every page

• DPDP for professional firms

  Chartered accountants, law firms, company secretaries and consultants. Covers client files, third-party data, email and retention.

  Particular to this sector: Data about people you never met, held for years

• DPDP for housing societies and RWAs

  Housing societies, resident welfare and apartment owners' associations. Covers resident registers, visitor logs, gate apps, CCTV and committee hand-over.

  Particular to this sector: The society is the fiduciary, not the secretary

• DPDP for jewellers

  Jewellery retailers, wholesalers and manufacturers. Covers KYC for high-value sales, occasion dates, savings schemes and CCTV.

  Particular to this sector: KYC you must keep, and data you only want to keep

Not listed? Choose “Other business” in the readiness check to answer the core questions every business needs to answer, including hospitality, manufacturing and B2B services.