BFSI & FinTech
Banking, insurance, payments and lending. Your regulator already sets where data lives and how long you keep it. Where that is stricter, it wins.
Industries
If you handle personal data, this applies to you
The Act is broad on purpose. If you’re not sure whether it applies, assume it does. Then work out which duties matter most for your kind of organisation.
Who it covers
Inside India and outside it
Organisations in India
Any organisation handling digital personal data in India, whatever its size or sector. There is no exemption for being small.
Organisations outside India
If you handle personal data while selling goods or services to people in India, the Act applies to you too.
By sector
Your regulator still matters
The privacy law adds to the rules you already follow. Where they disagree, the stricter one wins, and sometimes that isn’t the DPDP Act.
Healthcare & pharma
Hospitals, labs and manufacturers. Treating a patient doesn't let you use their data however you like, and medical confidentiality rules still apply.
Education & EdTech
Schools, universities and learning platforms. The allowance for looking after students is narrower than most think.
E-commerce & retail
Online and in-store retail. There is no special allowance for selling, and some common marketing tactics are not allowed at all.
IT & SaaS
Software and cloud companies handle personal data for themselves and for their customers. That means two sets of duties.
Telecom
Operators and internet providers hold identity, location and usage data at scale. Security, retention and sharing need constant attention, not a one-off project.
Manufacturing
Manufacturers still run CRM, warranty, dealer and HR systems full of personal data. There is no exemption for factories.
Travel & hospitality
Airlines, hotels and booking sites share identity and payment data with partners every day. Each share raises consent and retention questions.
Professional services
Law, consulting and accounting firms hold client data under contract and privilege. You still need a lawful reason, retention rules and proof of both.
By size and shape
The law is the same. The work is not.
A start-up and a bank face the same Act, but the hard parts are different.
Startups and SMEs
You collect data to grow, often before anyone owns compliance. The Act still applies, and a small team can't afford to find a big obligation late.
Mid-market businesses
Too much data for spreadsheets, but no full privacy team. This is where policy and practice drift apart most.
Large enterprises and conglomerates
Many brands, suppliers and older systems. A questionnaire signed at head office does not show what each business unit really does.
Regulated and public-facing institutions
Banks, hospitals and universities already answer to a regulator. Privacy work has to fit alongside those rules.
IT, SaaS and digital platforms
You hold product, customer and often partner data. Consent, deletion and supplier control get complicated when data passes between companies.
Global teams operating in India
Group policies written elsewhere don't automatically meet Indian law. Your Indian entity still has local deadlines, penalties and duties.
Find out what applies to you
Tell us about your organisation and we'll show you which parts of the Act matter most.