DPDP Act Sectoral
Analysis

The Digital Personal Data Protection Act, 2023 applies uniformly to every data fiduciary regardless of sector — it does not have industry-specific chapters. What differs is the practical implementation: the categories of personal data each industry handles, the consent and retention patterns, and the other regulators in play. Fintech must reconcile DPDP with RBI directions, healthcare aligns with clinical-record norms, and EdTech faces strict children’s-data rules. So the law is the same, but the compliance design is sector-shaped.

Banking and payments firms face dual compliance: the DPDP Act plus RBI directions, including data-localisation requirements for payment-system data. Where the two differ, the safe approach is to follow the stricter requirement — for example, keeping payment data in India per RBI while still meeting DPDP consent, notice, and breach-reporting duties for that data. Consent for transactions, credit assessment, and marketing should be unbundled so each purpose has its own lawful basis.

The DPDP Act does not create a separate "sensitive personal data" category the way GDPR does, but health data is high-risk in practice. Healthcare providers should obtain explicit consent for processing health data with a clear medical purpose, rely on the medical-emergency legitimate use only for genuine emergencies, give patients ready access to their records (a Section 11 right), and apply strong security controls. Many Indian providers voluntarily implement HIPAA-level safeguards even though HIPAA is not law in India.

Because the DPDP Act sets the age of a child at under 18, most EdTech platforms process children’s data and must obtain verifiable parental consent before processing. Section 9 also prohibits tracking, behavioural monitoring, and targeted advertising directed at children, and bars processing likely to cause harm. EdTech providers therefore need a robust parental-consent verification mechanism, profiling and ad-tracking disabled for minors, and clear parental access and control over a child’s data.

It depends on the data flow, and a SaaS company is frequently both. When it determines the purpose and means of processing — for its own users, billing, or product analytics — it is a data fiduciary. When it processes a customer’s end-user data strictly on that customer’s instructions, it acts as a data processor under a contract (a Data Processing Agreement). Mapping each data flow to the correct role is essential, because fiduciary duties (notice, consent, breach notification to principals) differ from processor duties. Tranquility Cybersecurity (TCSA) helps SaaS teams draw this line and paper it correctly.