Businesses & Professionals

DPDP by Industry

How India's DPDP Act plays out in your specific line of work — the obligations that actually bite for chartered accountants, healthcare, fintech, HR and more, beyond what the generic law tells you.

Chartered Accountants

4 GUIDES

DPDP for Chartered Accountants, ExplainedCA firms hold clients' PAN, Aadhaar, bank statements and financials — all DPDP-regulated. What applies to a CA practice, the retention conflict, and where to start.Annual audit document workflow under DPDP: a step-by-step guideAn audit engagement moves client, promoter and employee data through fieldwork and working papers — how to build a DPDP Act-compliant document workflow.DPDP checklist for accounting firmsA practical DPDP Act checklist for accounting firms — onboarding notice, document intake, audit-file access, retention clocks and vendor contracts.Do local CAs & tax consultants need a privacy policy?The DPDP Act names no document called a 'privacy policy' — but every CA or tax consultant needs the notice it usually carries. What a solo practice actually needs.

Healthcare

3 GUIDES

DPDP for Healthcare (hospitals, clinics, health apps), ExplainedHealth data is the most sensitive data there is — and most of it moves through WhatsApp and front desks. What the DPDP Act demands from healthcare, the emergency carve-outs, and where to start.Medical record retention under DPDP: how long, and when to eraseIndian medical-council rules set a 3-year floor for patient records, NABH-accredited facilities go higher — and the DPDP Act's erasure duty applies once that period ends.Can independent doctors & clinics share patient records via WhatsApp?WhatsApping a lab report to a patient isn't banned outright — but it skips channel control and leaves diagnoses sitting in chats and cloud backups.

Real Estate

2 GUIDES

DPDP for Real Estate Brokers, ExplainedA broker's phone holds buyers' KYC, sellers' deeds and lenders' files — and lead lists trade like inventory. What the DPDP Act demands from real estate, plus the PMLA duty most agents don't know they have.Secure handling of buyer KYC & property documents (including high-value deals)Real estate agents above a turnover threshold are PMLA reporting entities with their own KYC record duties — on top of the DPDP Act. What that means for buyer documents.

Recruitment & HR

4 GUIDES

DPDP for Recruitment & HR, ExplainedHR holds IDs, salaries, medical records and BGV reports. What the DPDP Act demands from recruitment and HR, what Section 7(i) really covers, and where to start.How long should HR retain employee documents under DPDP?India has no single retention period for employee records — payroll, PF, attendance and personnel files each follow a different law. How to build one schedule.Background verification & DPDP consent: what HR can collect and checkPre-employment background checks run on candidate consent, not the DPDP Act's employment exception, which only applies once someone is actually an employee.Reference checks & BGV agencies: can an employer call your previous boss without consent?Calling a candidate's previous employer without consent is a weak position under the DPDP Act — and a BGV agency adds a processor relationship to contract for.

Fintech

2 GUIDES

DPDP for Fintech (UPI, lending, neo-banks, NBFC KYC), ExplainedFintech is India's most data-regulated sector already — RBI, PMLA, digital-lending rules. What the DPDP Act adds on top, where the regimes interlock, and the cross-sell trap.Do co-operative banks face the same data-breach fines as major banks?The DPDP Act's penalty tiers key off the violation, not who regulates you. A co-operative bank faces the same ₹250/200/50 crore exposure as any major bank.

EdTech & Learning Platforms

2 GUIDES

DPDP for EdTech & Learning Platforms, ExplainedEdTech's users are mostly minors — which puts verifiable parental consent and the no-tracking rule at the centre of the product. What the DPDP Act demands from learning platforms.Exam proctoring & behavioural tracking of students under DPDPWebcam proctoring and behavioural analytics collect exactly the tracking the DPDP Act restricts for children. What EdTech platforms can and can't do.

E-Commerce & Online Stores

2 GUIDES

DPDP for E-Commerce & Online Stores, ExplainedE-commerce runs on addresses, payments and behaviour — through a mesh of couriers and platforms. What the DPDP Act demands from online stores, and who the 3-year erasure rule actually binds.The 3-year expiry: why e-commerce sites must delete inactive accountsThe DPDP Rules' 3-year erasure duty for inactive accounts applies only to e-commerce platforms with 2 crore or more users — not every online store.

MSMEs & Small Business

1 GUIDE

DPDP for MSMEs & Small Business, ExplainedMSMEs hold customer khatas, employee files and supplier data on phones and spreadsheets. What the DPDP Act actually asks of a small business — and why big clients will ask first.

Freelancers & Independent Consultants

1 GUIDE

DPDP for Freelancers & Independent Consultants, ExplainedA freelancer is two things under the DPDP Act: a fiduciary for their own clients and leads, and a processor for the client data that passes through their laptop. Both roles, explained.

Tutors & Coaching Classes

2 GUIDES

DPDP for Tutors & Coaching Classes, ExplainedA coaching class holds minors' data at solo scale — student lists, parent numbers, results marketing. What the DPDP Act demands from tutors and coaching centres, in plain terms.Coaching classes, student WhatsApp groups & fee records: parental consent at solo scaleA solo tutor's WhatsApp group and fee register hold as much minor's data as a school — without the school-specific relief. What parental consent needs to look like.

Micro-SaaS / Indie Founders

1 GUIDE

DPDP for Micro-SaaS & Indie Founders, ExplainedA solo founder carries the same DPDP duties as an enterprise — breach clocks included. The two-role model for SaaS, the 1-year log rule, and privacy-by-design while the codebase is small.

Law Firms & Legal Practices

4 GUIDES

DPDP for Law Firms & Legal Practices, ExplainedLitigation files are largely exempt from the DPDP Act — the practice around them isn't. The two-bucket model for law firms: the legal-claims exemption, what survives it, and where firms are exposed.Client–attorney document security under DPDP (privilege + confidentiality)Legal-claims work is exempt from most DPDP Act obligations — but the security-safeguards duty survives that exemption for privileged client documents.Handling litigation evidence and confidential agreements under DPDPDiscovery bundles and confidential agreements move personal data through email and shared drives more than any other legal work product. What the DPDP Act still expects.Client document retention under DPDP (legal-specific)The Bar Council sets no fixed file-retention period, unlike accounting or medical-council rules. What should drive how long a law firm keeps a client's file.

Immigration & Visa Consultants

2 GUIDES

DPDP for Immigration & Visa Consultants, ExplainedVisa files hold passports, finances, education and police records — and the work sends them abroad by design. What the DPDP Act demands from immigration consultants, with no sectoral regulator to hide behind.Sending client passports & documents abroad: cross-border rules for visa consultantsThe DPDP Act allows sending client passports to foreign embassies and partners by default — no country is currently restricted. What that rule still requires.

Insurance Brokers

2 GUIDES

DPDP for Insurance Brokers, ExplainedInsurance intermediaries handle the rare combination of health AND financial data. What the DPDP Act demands from brokers and agents, on top of IRDAI's conduct rules — and the claims-file trap.Handling health & financial sensitive data as an insurance brokerThe DPDP Act has no special 'sensitive data' category the way GDPR does — health and financial data get the same baseline rules as everything else.

Schools & Universities

2 GUIDES

DPDP for Schools & Universities, ExplainedSchools hold a generation's data — students, parents, staff. Where the Rules give institutions scoped relief, where they don't, and why the admission form is the exposure to fix first.DPDP, school WhatsApp groups & student-directory sharingA school's safety-tracking relief under the DPDP Act's Rules doesn't automatically cover a class WhatsApp group or a shared student directory.

Financial Advisors

1 GUIDE

DPDP for Financial Advisors, ExplainedAn advisor's files hold what banks never see — goals, family plans, full net worth. What the DPDP Act demands from financial advisors and distributors, on top of SEBI's record rules.

Company Secretaries

1 GUIDE

DPDP for Company Secretaries, ExplainedCS practices sit at the centre of director and beneficial-owner data — DIN, PAN, SBO declarations. What the DPDP Act demands on top of MCA filing duties.

Tax Practitioners

1 GUIDE

DPDP for Tax Practitioners, ExplainedTax practitioners hold clients' ITRs, Form 16s — and often their e-filing passwords. What the DPDP Act demands at filing-season scale, and why credential custody is your sharpest risk.

Digital Marketing & Ad Agencies

2 GUIDES

DPDP for Digital Marketing & Ad Agencies, ExplainedAgencies run campaigns on other people's data — client lists, pixels, bought databases. What the DPDP Act demands from marketing agencies, and why the bought list is now radioactive.Do digital marketing agencies need separate consent to track cookies in India?The DPDP Act doesn't name cookies, but tracking cookies are treated as personal data — non-essential ones need real opt-in consent, not a pre-ticked banner.

Hotels & Hospitality

2 GUIDES

DPDP for Hotels & Hospitality, ExplainedHotels sit at the intersection of the DPDP Act and a separate, mandatory foreign-guest reporting law. What changes at check-in, and where the real exposure is.Guest ID & passport handling at check-in: DPDP vs the Foreigners Act / Form C retentionFiling Form III justifies sending a foreign guest's passport data to the authorities — it doesn't justify how long the hotel keeps the scanned copy.

Gyms & Fitness

2 GUIDES

DPDP for Gyms & Fitness Studios, ExplainedBiometric attendance and body-metrics tracking make gyms bigger data handlers than they look. What the DPDP Act requires, and where consent must be explicit.Biometric attendance & member body-metrics: sensitive-data consent for gymsA fingerprint scanner and a body-composition log both need consent — but not the same consent. How to design the opt-in for each under the DPDP Act.

NGOs & Non-Profits

1 GUIDE

DPDP for NGOs & Non-Profits, ExplainedNGOs hold donor, beneficiary and sometimes child or health data — plus a separate FCRA reporting duty for foreign donors. What the DPDP Act demands.

Event Management & Photographers

1 GUIDE

DPDP for Event Managers & Photographers, ExplainedA photograph of an identifiable person is personal data under the DPDP Act — and consenting to be photographed isn't the same as consenting to how it's used.

Salons, Spas & Wellness

1 GUIDE

DPDP for Salons, Spas & Wellness Studios, ExplainedSalons collect more personal data than they look like — contact details every visit, birthdays for offers, before/after photos edging into health-adjacent territory.