An online shop, a lending platform and a hospital may all hold the same customer's name and phone number. They cannot use the same retention rule or assume that permission for one service covers every other use.
DPDP provides a common framework. The differences come from the purpose of processing, the people involved, conditional exemptions and other laws that apply to the business. Industry is a useful starting point, but the actual processing activity determines the answer.
This guide compares the decisions that change across sectors. Use it to identify the work your team needs to prioritise, then follow the detailed sector guide where the facts become specific.
Updated 3 October 2026. The main DPDP business obligations and relevant Rules are scheduled to commence in May 2027 under the government's notification. Existing sectoral and cybersecurity requirements have their own commencement and reporting rules.
Where the practical differences show up
| Business context | Consent and purpose | Retention question | Children's-data question | A useful first check |
|---|---|---|---|---|
| E-commerce | Separate fulfilment, account operation, advertising and optional marketing | Which order records have legal retention duties, and does the Third Schedule's inactivity rule apply? | Are children being tracked or targeted with advertising? | Trace a purchase from checkout through marketing and deletion |
| Fintech | Map the lender, service provider and each use of KYC or transaction data | Which entity must retain which record, and when does its retention clock start? | Does the product or account journey involve anyone under 18? | Trace a closed account through the active app, KYC archive and service providers |
| Healthcare | Distinguish clinical consent, data processing, emergency use and optional communications | Which clinical, billing and other records must be retained under the applicable rules? | Does the healthcare exemption cover this provider and this activity? | Follow a patient record through registration, treatment, referrals and billing |
| Education and EdTech | Identify the school and vendor's roles and the route for student-data processing | Which records serve ongoing educational purposes or legal requirements? | Does a conditional exemption apply, or is verifiable parental consent required? | Inspect signup and the analytics events sent before and after consent |
| Businesses using WhatsApp | Identify the purpose of each message and subsequent reuse | Which conversations or attachments are needed, where else are they copied, and for how long? | Is the business communicating with or collecting data about children? | Follow one chat from the inbox to the CRM, spreadsheets and backups |
WhatsApp is a communication channel used across industries. A clinic or lender using it still needs to assess the rules for its own activity. The channel does not create a separate category of fiduciary under the Act.
Consent: start with what the person is trying to do
Sections 4 to 7 of the Act establish the processing framework, including consent and certain legitimate uses. A business should identify the applicable route for each purpose instead of treating a general privacy-policy acceptance as permission for everything.
For an online shop, a delivery address supplied to fulfil an order presents a different question from using that customer's behaviour for advertising. Section 7(a) can be relevant where data is voluntarily provided for a specified purpose and the person has not indicated non-consent. It is not a general permission for unrelated reuse.
For a healthcare provider, clinical consent to a procedure and the basis for processing personal data need distinct analysis. Section 7(f)'s medical-emergency ground concerns a threat to life or an immediate threat to health. Routine scheduling and promotional messages need their own assessment; they do not inherit the emergency justification.
For a fintech, map the specific lender, lending service provider and purpose. Evidence that someone authorised a financial-data transfer does not, by itself, establish permission for every subsequent marketing or analytics use. Apply the relevant RBI requirements alongside the DPDP assessment.
For education, start with the child's age, the decision-making entity and the conditions of any applicable exemption. A school's procurement approval is not a substitute for documenting the legal route for each activity.
For a WhatsApp conversation, distinguish answering a person's enquiry from adding them to a recurring promotional campaign or sharing their details elsewhere. Keep evidence of the purpose and relevant choices. Moving a conversation into a CRM does not expand the permission that came with it.
A useful review exercise is to ask each team to show where the purpose changes. Checkout to advertising, treatment to wellness marketing, and a course enquiry to a sales campaign are all points where the next use deserves a fresh assessment.
Retention: a minimum, an inactivity trigger and an erasure duty can coexist
The question is not simply “How long does our industry keep data?” It is “Which record, for which purpose, under which requirement, starting from which event?”
Section 8(7) provides an erasure framework with an exception where retention is necessary for compliance with law. The final Rules add several distinct requirements:
- Rule 8(3) requires a minimum one-year retention period for covered personal data, associated traffic data and processing logs, for the Seventh Schedule purposes.
- Rule 6 contains a security-related retention requirement for the data and logs described there.
- Rule 8(1) and the Third Schedule establish an inactivity-based erasure rule for specified classes of businesses and purposes.
The Third Schedule covers e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore. The period is three years from the latest relevant event specified in the Schedule, including commencement. Certain account and virtual-token access purposes are excepted. Rule 8 also preserves necessary legal retention and requires at least 48 hours' advance notice before the relevant erasure period ends.
That is not a universal three-year limit on every record held by every online shop. Nor does falling below a Schedule threshold remove the other applicable erasure and retention duties.
The practical differences become clearer at record level:
| Record | What the retention decision needs |
|---|---|
| A shop's transaction record | The applicable accounting, tax and other legal requirements, alongside DPDP retention duties |
| A regulated lender's customer-identification record | The applicable KYC and anti-money-laundering rules and the correct closure or relationship-end trigger |
| A hospital's treatment record | The provider, record type and applicable clinical or other legal requirements |
| A school's student record | Its educational purpose, applicable legal duties and the distinction between the institution's record and a vendor's copy |
| A WhatsApp attachment exported to a spreadsheet | A reason for the copy to exist, its owner, access controls and the applicable retention or deletion decision |
For example, Section 12 of the Prevention of Money-laundering Act uses different five-year triggers for transaction records and the client-identification, account-file and correspondence records it covers. Applying “five years from signup” to all of them would miss the point.
Retaining a record for legal reasons does not make it available for any commercial use. Give retained archives suitable access restrictions and connect the retention end date to an actual review or erasure process.
Children's data: education and healthcare both have conditional exemptions
Section 9 creates requirements around parental consent, tracking, behavioural monitoring, targeted advertising and the child's well-being. Rule 12 and the Fourth Schedule contain conditional exemptions from Sections 9(1) and 9(3).
| Context | What the published exemption requires you to assess |
|---|---|
| Specified healthcare establishments and professionals | The listed type of provider and processing limited to necessary health services for the child |
| Allied healthcare professionals | The listed role and necessary support for the relevant treatment and referral plan |
| Educational institutions | Whether the entity qualifies and whether tracking or behavioural monitoring stays within its educational activities or the safety of enrolled children |
| School transport providers in the listed category | The specified engagement and safety-related location tracking during the child's journey |
| Other products and activities involving children | Whether another specific purpose-based or class-based exemption applies; otherwise the relevant Section 9 requirements remain |
The Schedule defines an educational institution to include an institution of learning imparting education, including vocational education. A product team should examine the definition and activity rather than assume that all commercial EdTech is excluded or all education software is covered.
The separate restriction in Section 9(2), concerning processing likely to harm the child's well-being, remains relevant where Rule 12 applies. Parental consent also does not, by itself, override the Section 9(3) restrictions.
Our EdTech guide works through signup and analytics decisions. The healthcare guide follows the patient-data journey and its conditional exceptions.
Breach reporting: identify the incident, the entity and the recipient
A reporting plan needs to identify which obligations are triggered by the facts. “We are in fintech” or “we have 72 hours” is not a complete analysis.
| Reporting route | Relevant trigger and timing | What to prepare |
|---|---|---|
| DPDP Board notification under Rule 7 | Personal data breach: initial intimation without delay; detailed update within 72 hours of awareness, unless the Board permits longer on a written request | An initial report, investigation updates and an authorised owner |
| Notification to affected Data Principals under Rule 7 | Notification without delay, to the best of the fiduciary's knowledge | Clear information about the breach, likely consequences, protective steps and a contact |
| CERT-In under its 2022 Directions | Specified incident categories in Annexure I, reported within six hours of noticing or being informed, for entities covered by the Directions | Incident classification, reporting contact and evidence preservation |
| Sectoral regulator or contractual reporting | Depends on the entity, applicable instrument and incident | The exact provision, deadline, recipient and relationship owner |
Sources: DPDP Rules, Rule 7 and CERT-In Directions of 28 April 2022.
A lender may need to assess RBI reporting in addition to DPDP and CERT-In. That does not establish a universal RBI deadline for every fintech or mean that no other industry has additional reporting duties.
Run a tabletop exercise with an actual vendor incident. Ask who becomes aware first, what information reaches your organisation and who can authorise each notification. The earliest applicable reporting obligation may arrive before the vendor has completed its investigation.
Choose the first control that exposes the real gaps
A broad checklist is useful, but one well-chosen journey can reveal more about readiness than a pile of completed policy tasks.
E-commerce: place a test order, decline optional marketing and then close the account. Check what reaches the advertising tools, which records remain and whether the response explains retention.
Fintech: trace a closed loan account. Distinguish the lender's required records, the service provider's permitted copies and active marketing uses. Use the fintech guide to examine the different retention triggers.
Healthcare: follow one patient record through registration, consultation, diagnostics, referrals and billing. Identify every recipient and the purpose for each transfer. Include paper information once digitised; the medium at collection does not settle applicability.
Education: inspect one child's signup and a normal lesson. Verify the route used for processing, what the SDKs transmit and which teachers or vendors can access the record. Include the end-of-term exit process.
WhatsApp: take one customer conversation and locate every copy. A shared inbox, an employee's export, a CRM attachment and a spreadsheet may all need different owners. Our WhatsApp Business guide covers the channel in more detail.
For each exercise, keep the same evidence: the activity, the applicable rule, the owner, the decision and proof that the intended behaviour occurred. The business context determines the decisions; the evidence makes them reviewable.
Frequently asked questions
The main DPDP business duties discussed below are scheduled to commence in May 2027 under the government's commencement notification. Existing sectoral and cybersecurity requirements operate on their own timelines.
Does DPDP apply differently to different industries?
DPDP provides a common processing framework, but the decisions businesses must make differ by activity and applicable sectoral law. A lender's KYC record, a hospital's treatment record and a shop's marketing list may need different retention and access rules. Conditional exemptions and specific Rules also matter. Assess the entity, purpose, record and legal requirement instead of assigning one answer to an entire industry.
Sources: DPDP Act, Sections 4, 8, 9 and 16; DPDP Rules, Rules 8 and 12.
Can we use one privacy-policy template for every business or service?
A shared template can help with consistency, but each service's notice needs to describe its actual data and purposes. Where DPDP consent is sought, Section 5 and Rule 3 set the notice requirements. A hospital referral, a lending application and an advertising campaign should not disappear into the same vague description. Use a common structure, then check it against the data flow and choices for each service.
Sources: DPDP Act, Section 5; DPDP Rules, Rule 3.
Does DPDP require every business to delete customer data after three years?
The three-year inactivity rule is not a universal retention limit. Rule 8 and the Third Schedule apply it to specified classes of e-commerce, online gaming and social media businesses, with user thresholds, defined triggers and exceptions for certain purposes. Other erasure duties and necessary legal retention still need assessment. Build retention rules by record category rather than deleting every customer record on its third anniversary.
Sources: DPDP Rules, Rule 8 and Third Schedule; DPDP Act, Section 8(7).
Does every use of personal data require consent under DPDP?
DPDP provides for consent and the certain legitimate uses listed in Section 7. Consent is therefore not the only processing route, but a general business need is not a substitute for an applicable ground. Identify the specific purpose and check the conditions. Information supplied to fulfil an order or respond to a medical emergency does not automatically become available for an unrelated promotional campaign.
Sources: DPDP Act, Sections 4, 6 and 7.
Does DPDP require every industry to store all personal data in India?
The DPDP Act does not impose a universal India-only hosting rule. Section 16 provides for government restrictions on transfers and preserves other laws offering a higher degree of protection or restriction. Sectoral requirements and applicable government measures need their own assessment. An organisation should check the rules for its particular data flow, including backups and vendor tools, rather than treating a cloud region as the whole answer.
Sources: DPDP Act, Section 16; DPDP Rules, Rules 13 and 15.
Is the breach-reporting deadline six hours or 72 hours?
The six-hour and 72-hour periods belong to different reporting duties. CERT-In's existing directions cover specified incident categories and entities, with six hours counted from noticing or being informed. DPDP Rule 7, scheduled to commence in May 2027, calls for initial notifications without delay and a detailed Board update within 72 hours of awareness, unless extended on a written request. Assess each applicable duty, including sectoral reporting.
Sources: CERT-In Directions, 28 April 2022; DPDP Rules, Rule 7.
Turn the comparison into assigned work
Bring legal or privacy, engineering, operations and the relevant business owner into the same review. Select one journey, resolve the unclear decisions and assign the changes with completion evidence.
Avoid copying a retention table from another industry without its conditions. Equally, avoid building five separate compliance programmes because the company operates in five sectors. A shared inventory, request process and evidence system can support different rules for different activities.
ComplyZero is a DPDP compliance platform for Indian businesses, built by data protection lawyers and cybersecurity experts. Book a DPDP walkthrough to connect your sector-specific decisions to controls, owners and evidence.
This article is for informational purposes and reflects the DPDP Act 2023 and DPDP Rules 2025 as understood at the time of writing. For guidance specific to your business, we recommend consulting a qualified data protection professional.
