DPDP compliance looks different across industries

Organisations have common responsibilities under the Act, but how they meet them depends on the data they process and why. A useful assessment follows a person’s data from collection through use, sharing, retention and deletion.

• People and age: a school or edtech platform may process children’s data; an employer handles candidate and staff information; a housing society deals with residents, visitors and domestic workers.
• Purpose and context: a hospital supports care; a lender evaluates and services credit; a hotel manages reservations, identity checks and guest services.
• Vendors and roles: SaaS businesses may act as processors for customers and as Data Fiduciaries for their own accounts, billing and support.
• Other rules: sector regulations may impose additional safeguards, records or retention periods alongside DPDP duties.
• Scale and designation: some duties depend on whether an organisation is notified as a Significant Data Fiduciary or falls into a class named in the Rules.

The DPDP Act does not create a simple list of “regulated” and “unregulated” industries. Map each activity, role and applicable exception before deciding what controls are needed.