Guides
DPDP for your industry
The obligations come from what your organisation does with personal data, not from your industry label. These guides explain which official duties tend to matter most in each sector and why, with links to the official text.
Industry guide
Startups
No startup exemption notification under section 17(3) of the Act was found in the MeitY library or India Code at the 2 October 2026 check. What startups get is time: the main operational duties arrive with lead time, which rewards building the plan early.
Read
Industry guide
SaaS
SaaS companies usually sit on both sides of the framework: Data Fiduciary for their own users and Data Processor for customer data. The distinction decides which duties are yours directly.
Read
Industry guide
Ecommerce
High volume consumer data, guest checkouts, marketing consent and platform retention timers make ecommerce one of the most directly affected sectors.
Read
Industry guide
Healthcare
Health services process deeply personal data, often for children and for persons with lawful guardians, and often under other laws that continue to apply alongside the DPDP framework.
Read
Industry guide
Fintech
Financial data flows through fiduciaries, processors and, once registered with the Board, Consent Managers, under sector regulators whose requirements continue alongside the DPDP framework.
Read
Industry guide
Education and edtech
From 13 May 2027 (computed date, interpretation until officially confirmed), when section 9 of the Act and Rules 10 and 12 commence, the verifiable parental consent duty and its targeted exemptions under Rule 12 and the Fourth Schedule are the centre of gravity for this sector, because learners are often children.
Read