Industry guides
The DPDP Act sets the same duties for every Data Fiduciary, but a bank, a kirana store and a learning app meet them in very different ways. Each guide sets out the data you hold, where the risk sits, the legal basis for each purpose, and a checklist your team can tick through, with owners.
Guides are in English. They are general guidance, not legal advice.
Start here · 24 min read
The baseline every Data Fiduciary has to meet under the DPDP Act 2023 and Rules 2025: roles, the core duties, a 90-day programme, owners, a master checklist, and where a Consent Manager fits.
Shops, clinics of one, firms and charities that hold customer data on phones, spreadsheets and billing software.
Risk: Standard27 min read
Kirana and neighbourhood shops, local service businesses (repairs, tailoring, tuition, travel agents, event planners), small manufacturers, traders and distributors, and freelancers or consultants with staff, who keep customer data on WhatsApp, phones, Tally or billing apps, Google Sheets and Excel.
Risk: Elevated25 min read
Physical retail chains and franchise stores, malls and department stores, restaurants, QSR chains, cafes and cloud kitchens, salons, spas and clinics offering beauty services, gyms, fitness studios and yoga centres.
Risk: Elevated25 min read
Chartered accountant and CS firms, tax practitioners, law firms and advocates in practice, management and IT consultants, architects and interior designers, valuers, recruitment firms, executive search and staffing or contract-manpower agencies.
Risk: Elevated26 min read
Registered trusts, societies and section 8 companies, community-based organisations, CSR implementing agencies and foundations, fundraising platforms run by charities, and NGOs working in health, education, livelihoods, child protection, disability and relief.
Online businesses with large user bases, tracking and marketing at scale.
Risk: Elevated19 min read
Online marketplaces, D2C brands on their own site or app, quick-commerce and grocery delivery, sellers on Shopify, WooCommerce or similar, and social-commerce sellers on Instagram and WhatsApp.
Risk: Elevated28 min read
Online travel agencies, hotel chains and independent hotels, homestays and serviced apartments, airlines, travel agents, tour operators, DMCs, and corporate travel management companies.
Risk: High27 min read
Online gaming platforms and studios: real-money and fantasy platforms (including those winding down or pivoting), casual and mobile game publishers, multiplayer and social games, esports organisers and tournament platforms.
Risk: High27 min read
Social networks, messaging-led communities, forums and Q&A sites, dating and matrimony apps, short-video and creator platforms, fan-subscription and newsletter platforms, and user-generated content sites.
Risk: High27 min read
News and content publishers, OTT and streaming services, ad networks, SSPs and DSPs, data management platforms, marketing and media agencies, lead-generation and affiliate businesses, and bulk SMS, WhatsApp and email marketing providers.
Regulated entities where DPDP sits on top of RBI, SEBI, IRDAI and PMLA duties.
Risk: High28 min read
Scheduled commercial banks, small finance and payments banks, urban and rural cooperative banks, NBFCs, housing finance companies, microfinance institutions, and digital lenders working with a regulated lender.
Risk: High25 min read
Payment aggregators and gateways, UPI third-party apps, wallet and PPI issuers, BNPL and lending apps, neo-banks, wealthtech and robo-advisory apps, stock brokers and investment platforms, and insurtech distribution apps.
Risk: High26 min read
Life, general and health insurers, insurance brokers and web aggregators, third-party administrators, corporate agents such as banks and NBFCs, individual agents and POSPs, and insurtech platforms.
Sensitive data and children, where mistakes hurt people the most.
Risk: High27 min read
Hospitals and nursing homes, clinics and doctor practices, diagnostic labs and collection centres, retail pharmacies and e-pharmacies, telemedicine platforms, and health, fitness and wearable apps.
Risk: High27 min read
Schools and school chains, colleges and universities, coaching and tuition centres, edtech apps, test-prep and online tuition platforms, and the transport, ERP and proctoring vendors that serve them.
Employees, residents, riders and subscribers: data you hold because of how you operate.
Risk: Elevated25 min read
Any employer in India: companies, start-ups, factories, hospitals, schools, retailers, NGOs and government contractors, and the HR, payroll, admin and IT teams that run their people processes.
Risk: Elevated27 min read
Real estate developers and their sales teams, channel partners and brokers, property portals and rental platforms, resident welfare associations (RWAs), co-operative housing societies, apartment owners associations, and facility management companies.
Risk: Elevated26 min read
Courier and express companies, last-mile and hyperlocal delivery firms, 3PL and warehousing operators, ride-hailing and bike-taxi aggregators, fleet and leasing operators, school and staff transport operators, and quick-commerce and food-delivery rider networks.
Risk: High26 min read
Mobile network operators, virtual network operators, broadband and fibre ISPs, enterprise connectivity providers, cable operators and MSOs, DTH platforms, and their franchisees, distributors and retail point-of-sale agents.
For businesses that process personal data on behalf of others.
Risk: Elevated25 min read
B2B SaaS companies, IT services and managed services firms, cloud and data-centre providers, BPO, KPO and call-centre operators, analytics and AI vendors, and any business that processes personal data on behalf of another business.
This site uses only what it needs to work. Anything optional stays off until you say yes.