The Act Is Sector-Neutral. Except Where It Isn't.

The DPDP Act defines a Data Fiduciary by what it does with personal data, not by what industry it is in. But the Rules name three classes outright, and six more sectors have a provision written around them. These are those sectors.

Most sector guidance on this Act is the same checklist with a different logo, and it is worth saying why. The statute is deliberately drafted to be sector-neutral: obligations attach to the processing of digital personal data, so a hospital, a bank and a bookshop owe substantially the same duties. Writing nine versions of that is not useful to anyone.

What is useful is the set of places where the framework does distinguish. There are more of them than the Act alone suggests, because most sit in the Rules: the Third Schedule names e-commerce, online gaming and social media with their own retention clocks and user-count thresholds, and the Fourth Schedule switches the children’s provisions off for clinical care. The Act itself reserves section 17(1)(f) for lenders, section 17(1)(d) for offshore IT services, section 17(3) for startups and sections 7(b) and 17(2)(a) for the State.

Each guide below names the provision it rests on. If your sector is not here, that is the answer rather than an omission - the general regime applies, and the eleven obligations are the right place to start.

The nine at a glance

Each sector, what it also covers, the number that matters and the provision that sets it
Sector	Also covers	The number that matters
E-commerce & retail	online stores, marketplaces, D2C brands, quick commerce, retail chains	2 croreregistered users in IndiaThird Schedule
Online gaming	real money gaming, fantasy sports, mobile games, esports platforms	50 lakhregistered users in IndiaThird Schedule
Social media	social networks, content platforms, community apps, creator platforms	2 croreregistered users in IndiaThird Schedule
Healthcare	hospitals, clinics, diagnostic labs, telemedicine, pharmacies, mental health services	Part Aclasses exempt from § 9(1) and 9(3)rule 12
Banking & financial services	banks, NBFCs, fintech, lending apps, insurance, wealth platforms	10 yearsclient identity records, by law§ 8(7)
EdTech & education	schools, colleges, coaching centres, test prep, K-12 platforms, training institutes	18age below which a learner is a child§ 2(f)
SaaS & IT services	B2B software, IT services, BPO, cloud platforms, developer tools	2roles at once: Fiduciary, Processor§ 2
Startups	DPIIT-recognised startups, early stage companies, seed and Series A teams	5provisions § 17(3) could disapply§ 17(3)
Government & public sector	central and state departments, municipal bodies, public sector undertakings, welfare schemes	§ 7(b)subsidies and services, no consent§ 7(b)

Third Schedule · rule 8(1)E-commerce & retailMost sectors have to reason by analogy from a general statute. E-commerce does not: it is one of three classes the Third Schedule names outright, and the Act uses online marketplaces in three of its own illustrations.Read the guide

Third Schedule · § 9Online gamingOnline gaming intermediaries reach the Third Schedule's retention duty at fifty lakh users - a quarter of the trigger for e-commerce and social media. Then section 9 removes two things much of the sector is built on.Read the guide

Third Schedule · § 3(c)(ii)Social mediaSocial media intermediaries are a named Third Schedule class. They are also the beneficiary of the Act's most consequential exclusion - and its illustration is about a blogger posting to social media.Read the guide

Fourth Schedule · § 38(1)HealthcareThe SPDI Rules singled out medical records and physical and mental health condition for heightened protection. The DPDP Act abandons the category entirely - and then carves healthcare out of the children's provisions so that consent cannot gate a child's treatment.Read the guide

§ 17(1)(f) · § 38(1)Banking & financial servicesFinancial services is the only sector with an exemption drafted around its own business problem - and the Act illustrates both that exemption and its retention rule with a bank.Read the guide

§ 9 · rule 10EdTech & educationFor most sectors section 9 is an edge case handled by an age gate. For education it is the centre of the compliance problem, because the Act's definition of a child covers most of the student body.Read the guide

§ 8(1) · § 8(2) · § 17(1)(d)SaaS & IT servicesA SaaS company is a Data Processor for its customers' data and a Data Fiduciary for its own users' data - usually in the same system, often in the same table. The Act treats those two positions very differently.Read the guide

§ 17(3)StartupsSection 17(3) singles out startups for potential relief from five obligations. It is an enabling power, not a live exemption - and the difference matters more than any other point on this page.Read the guide

§ 7(b) · § 17(2)(a)Government & public sectorSection 7(b) lets the State provide subsidies, benefits, services, certificates, licences and permits without consent. Section 17(2)(a) can take a notified instrumentality outside the Act altogether. Neither is a blanket exemption, and the difference between them is the whole point.Read the guide

Every provision cited across these guides can be read in context in the full text of the Act or verified against the MeitY publication.

Implementation

Applying the Act by sector

Does the DPDP Act have different rules for different industries?

Mostly no, and that is the point worth understanding first. The Act defines a Data Fiduciary by what it does with personal data rather than by sector, and almost every obligation applies identically everywhere. The exceptions are specific and findable: the Third Schedule to the Rules names three classes with their own retention thresholds, the Fourth Schedule disapplies the children's provisions for defined classes, and sections 17(1)(d), 17(1)(f), 17(2)(a), 17(3) and 7(b) carve out particular situations.

Which industries are actually named in the Act or the Rules?

E-commerce entities, online gaming intermediaries and social media intermediaries are named in the Third Schedule with user-count thresholds. Clinical establishments, mental health establishments and healthcare professionals begin Part A of the Fourth Schedule. Financial institutions appear in section 17(1)(f). Startups are named in section 17(3). The State and its instrumentalities appear in sections 7(b) and 17(2)(a).

My sector is not listed here. What applies to me?

The whole Act, without sector-specific modification - which is the ordinary case rather than a gap. Start with the eleven obligations in Chapter II and the rights in Chapter III, then check whether you cross a Significant Data Fiduciary threshold under section 10. We have not written a page for sectors with no distinct statutory treatment, because it would be the same guidance with a different heading.

Do these guides replace legal advice?

No. They are educational summaries anchored to specific provisions so you can verify each claim against the statute yourself, and every page links to the section text and to the MeitY publication. Applying them to your organisation's facts - particularly on the exemptions, which are all bounded by purpose - is work for a qualified adviser.

Start here instead

The eleven obligationsChapter II, which applies to every sector on this page Applicability checkerWork out which provisions reach your organisation Compliance checklistA working sequence once you know what applies

DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against industry implementation guides. Educational information, not legal advice.

Review standards and attribution →