For each sector: the data you hold, the laws that overlap with the DPDP Act, where things usually go wrong, and a checklist to start with.
SaaS & IT services
SaaS companies often act as Data Processors for their customers and Data Fiduciaries for their own users, staff and leads. Getting that split right decides who owes what under the DPDP Act.
Data you likely hold
Customer end-user records
Product analytics and logs
Sales and marketing leads
Employee data
Overlapping rules
CERT-In 6-hour incident reporting
Customer contracts and DPAs
GDPR for EU customers
Common risks
Unclear processor vs fiduciary roles
Sub-processors without contracts
Logs kept forever
Analytics without a lawful basis
Starter checklist
Record your role for each data flow
Sign DPAs with every sub-processor
Set retention for logs and backups
Build a breach playbook that meets both CERT-In and DPDP timelines
Help customers answer rights requests through your product
Financial firms process identity, transaction and credit data at scale. DPDP duties sit on top of RBI, SEBI and IRDAI rules, so the job is to align them, not run them separately.
Data you likely hold
KYC and Aadhaar-linked data
Transaction and account data
Credit and bureau data
Device and location data for fraud checks
Overlapping rules
RBI Digital Lending Guidelines (2022) limits on data collection and device access
RBI outsourcing and IT governance directions
Payment data storage localisation (RBI, 2018)
CERT-In reporting
Common risks
Loan apps collecting contacts or photos
Data shared with lending partners without clear purpose
Retention clashes between DPDP and KYC record-keeping
Automated decisions customers cannot question
Starter checklist
Map each purpose to consent, legitimate use or legal obligation
Restrict app permissions to what the product needs
Review lending-service-provider and fintech partner contracts
Align retention with PMLA/KYC rules and delete after
Health data is highly sensitive and widely shared between hospitals, labs, insurers, apps and the ABDM ecosystem. A breach here causes real harm, which is why regulators and patients watch it closely.
Data you likely hold
Medical records and prescriptions
Lab reports and images
Insurance and billing data
Wearable and app data
Overlapping rules
Ayushman Bharat Digital Mission (ABDM) health data management policy
Clinical Establishments and telemedicine guidelines
Anyone under 18 is a child under the DPDP Act. Edtech platforms must get verifiable consent from a parent or guardian and must not track, behaviourally monitor or target ads at children, except where the Rules exempt it.
Data you likely hold
Student profiles and grades
Parent contact details
Learning analytics
Video and proctoring data
Overlapping rules
School and board policies
Exemptions in the Rules for educational institutions for specific purposes
Online retail touches marketing, payments, logistics and support. Each hand-off is a place where data leaks or is used beyond what the customer agreed to.
Every employer is a Data Fiduciary for its staff and candidates. The Act lets employers process some data for employment purposes as a legitimate use, but notice, security and retention duties still apply.
These guides give general information based on the DPDP Act, 2023, the DPDP Rules, 2025 and the sector rules named. They are not legal advice for a particular organisation.