Industry & Role Guides
← All postsDPDP Act for SaaS and IT Services Companies: A Compliance Guide
SaaS and IT services firms are usually Data Processors for their customers' data and Data Fiduciaries for their own: leads, users, employees and product analytics. Under the DPDP Act, customers stay liable and will push obligations down through contracts, so DPDP readiness becomes a sales requirement. Using customer data to train AI features can turn you into a fiduciary. Indian firms processing foreign individuals' data for foreign clients may fall within the Section 17(1)(d) exemption, but security duties remain.
DPDP Act for E-commerce and D2C Brands: A Compliance Guide
For e-commerce and D2C brands, the DPDP Act bites hardest on marketing, cookies and retention. Order data can be processed to fulfil orders, but promotions, retargeting and ad audiences need consent. Marketplaces with two crore or more Indian users must erase inactive users' data after three years with 48 hours' notice. Sellers, logistics partners and payment gateways must be governed by contract, and consent flows must avoid the dark patterns India's consumer regulator prohibits.
ReadDPDP Act for Insurance Companies: A Compliance Guide
Insurers process health, financial and family data at scale, through long chains of agents, brokers, banks, TPAs and hospitals. The DPDP Act applies on top of IRDAI rules. Policy and claims processing can generally rely on data customers provide for that purpose, but cross-selling, lead buying and intermediary sharing need care. Records rules from IRDAI survive erasure requests, and large insurers should prepare as likely Significant Data Fiduciaries.
ReadDPDP Act for Staffing and HR Tech Companies: A Compliance Guide
Staffing firms, RPOs, job platforms and HR tech vendors hold some of the largest personal data sets in India: candidate databases running to millions of records. Under the DPDP Act, they are usually Data Fiduciaries for their own databases and processors for client work. Sharing CVs with clients needs candidates' informed agreement, databases need retention limits, AI screening must be transparent, and deployed workers' data must be handled as an employer's.
ReadDPDP for HR Leaders: What You Own and What to Do First
HR holds more personal data than almost any other function: candidates, employees, contractors, interns and former staff, much of it sensitive. Under the DPDP Act, most employment processing can rely on the Section 7(i) legitimate use rather than consent, but notices, security, vendors, retention limits and breach reporting all still apply. HR leaders should map their data, separate employment needs from extras, tighten vendor contracts and set retention schedules before 13 May 2027.
ReadDPDP for Founders and CEOs: What You Own and What to Do First
For founders and CEOs, the DPDP Act is a leadership issue, not just a legal one. Penalties reach ₹250 crore per instance, enterprise customers and investors will ask about compliance, and the main obligations apply from 13 May 2027. Leadership must own five decisions: an accountable owner, budget, which data the business really needs, risk appetite on vendors and marketing, and how progress is reported to the board.
ReadDPDP Act for Edtech and Schools: A Compliance Guide
Most education businesses process children's data, so Section 9 of the DPDP Act applies: verifiable parental consent, and no tracking, behavioural monitoring or targeted advertising directed at children, with penalties up to ₹200 crore. Rule 12 and the Fourth Schedule exempt educational institutions only for monitoring tied to educational activities or student safety. Consumer edtech apps should not assume the exemption covers them, and advertising to students is off-limits.
ReadDPDP Act for Healthcare: A Compliance Guide for Hospitals, Labs and Health Apps
The DPDP Act does not create a special category for health data, but healthcare is one of its most exposed sectors. Treatment data patients provide can usually be processed for that purpose, and emergencies have their own legitimate use. Hospitals and doctors are exempt from verifiable parental consent only for health services to a child (Rule 12 and Fourth Schedule). Marketing, analytics pixels, health apps and research need careful treatment, and ransomware makes breach readiness essential.
ReadDPDP Act for Fintech and Payments Companies: A Compliance Guide
Fintech and payments companies face the DPDP Act on top of RBI rules, often inside partnerships where it is unclear who the Data Fiduciary is. Settle roles first, partnership by partnership. Then fix the areas where fintech is most exposed: app permissions and third-party SDKs, consent for cross-selling and credit data, account aggregator flows, localisation, and breach response. Large payment and lending platforms should prepare as likely Significant Data Fiduciaries.
ReadDPDP Act for Banks and NBFCs: A Compliance Guide
Banks and NBFCs face the DPDP Act on top of RBI, PMLA and credit information rules, not instead of them. Retention required by law survives the DPDP erasure duty (Section 8(7)), but everything else must be erased when its purpose ends. Cross-selling, bureau sharing and app permissions need clear notices and, where consent is the basis, unbundled consent. Large lenders should prepare as likely Significant Data Fiduciaries. Being RBI-compliant does not make a lender DPDP-compliant.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.