The law does not ask
what industry you are in.
DPDPA 2023 applies to every organisation processing personal data of Indian residents. Your sector changes the risk. The obligation does not.
KYC data is not a formality.
It is a liability.
Every credit score, every UPI transaction, every insurance claim is built on personal data. DPDPA treats that data as borrowed trust — not owned asset.
- KYC data retained beyond onboarding purpose violates Section 8(7)
- Credit scoring algorithms must comply with transparency obligations
- NBFC loan data shared with recovery agents triggers third-party liability
- Payment aggregators hold India’s largest personal data stores — with matching exposure
→ Retention must end when purpose ends. Section 8(7).
Can you justify that retention to the Data Protection Board?
The five steps between you and ₹250 Crores.
Patient data is not a
medical record. It is sacred.
A diagnosis shared without consent is not a privacy violation. Under DPDPA it is a statutory breach. Health data carries the highest duty of care — and the highest penalty exposure.
- Telemedicine platforms must build consent architecture from day one
- Patient records shared with insurers require explicit, specific, fresh consent
- Mental health data, HIV status, genetic information treated with acute sensitivity
- Health aggregators and wearables face Significant Data Fiduciary scrutiny
→ Hospital shared it with insurer without fresh consent. Section 6(1) violated.
If the answer takes more than 3 seconds, you have a governance failure.
Small business.
Full obligation.
DPDPA 2023 has no SME exemption. A 20-employee company carries the same statutory obligations as a 20,000-employee enterprise. The penalty scale does not know your turnover.
- Customer databases, purchase histories, and CRM data are personal data
- Employee records — offer letters, medical leaves, performance reviews — all covered
- WhatsApp used for business creates unstructured personal data liability
- Vendor contacts require legitimate purpose documentation
→ The Data Protection Board has no minimum business size threshold. Section 2(i) applies to all.
All personal data. All your responsibility. All covered.
Move fast.
But not past the law.
Investor due diligence now includes DPDPA compliance. Enterprise clients are demanding Data Processing Agreements before signing. Growth built on non-compliant data is a liability.
- App onboarding collecting PAN, Aadhaar, location — each requires specific consent
- Growth retargeting without purpose-alignment is a statutory violation
- Third-party SDKs in your app — you are the fiduciary responsible for their data use
- Series A and beyond: compliance gaps discovered in due diligence kill valuations
→ Non-compliant data architecture was discovered in due diligence. The round did not close.
No to either. Your valuation just dropped.
The factory floor
is a data floor now.
Manufacturing organisations collect worker biometrics, vendor contracts, and supply chain data across every shift. DPDPA treats all of it as personal data — with full statutory obligations attached.
- Worker biometric data — fingerprints, retina scans, attendance records — requires explicit consent
- Vendor and contractor personal data held for procurement requires lawful basis and purpose limitation
- CCTV footage on the shop floor is personal data retention — subject to Section 8(7) erasure
- IoT sensors and wearable monitoring of workers trigger data principal rights obligations
→ Biometric data is personal data. Collecting it without consent violates Section 6.
All personal data. All your fiduciary responsibility. All covered.
From classroom to platform —
every learner is a data principal.
Educational institutions and EdTech platforms together hold the most sensitive and legally complex personal data in India — spanning minors, sensitive admissions records, biometric attendance, and decades of legacy data rarely audited or erased.
- Admission data — income certificates, caste documents, medical records — is sensitive personal data with strict purpose limitation
- EdTech platforms must obtain verifiable parental consent before processing any data of learners under 18
- Alumni databases repurposed for fundraising or marketing violate DPDPA Section 6(2) purpose limitation
- Behavioural analytics, learning patterns, and performance tracking on minors attract the highest regulatory scrutiny
- Exam data and assessment results shared with third-party companies require formal Data Processing Agreements
→ A minor cannot give DPDPA-valid consent for themselves. Section 9 requires verifiable parental consent.
→ Purpose was admission. Not fundraising. Section 6(2) violated.
Every cart. Every click.
Every return. A data trail.
E-commerce platforms generate the most granular consumer behavioural data in India — and distribute it across the widest ecosystem of sellers, logistics partners, and ad networks. DPDPA makes the platform responsible for all of it.
- Purchase history profiling used for retargeting without declared lawful purpose
- Third-party seller access to buyer personal data without Data Processing Agreements
- Abandoned cart tracking and re-engagement without fresh consent
- Delivery partner and logistics chain data sharing without DPA
- Return and refund process collecting additional personal data beyond original purpose
→ The platform is the Data Fiduciary. Seller access to buyer data is your liability. Section 8 applies to you.
Each platform, each data share, each ad impression — a purpose not declared at consent.
Banking holds India's
deepest personal data.
DPDPA holds banks accountable.
Banks and NBFCs operate under a dual regulatory burden — RBI directives mandate data retention while DPDPA grants erasure rights. This unresolved tension has no safe harbour. Until rules clarify, both risks coexist.
- Account statements and transaction histories shared with credit bureaus and analytics firms
- Nomination and beneficiary personal data held without purpose review
- Loan recovery communications sharing debtor personal data with collection agents
- Fixed deposit and investment data shared with wealth management partners
- Dormant account data retained for decades without statutory basis under DPDPA
→ No exemption issued. DPDPA Section 8(7) applies. The conflict is yours to navigate — not ignore.
No DPA. No purpose limitation. Full DPDPA liability on the lending bank.
The claim file holds
more than a number.
It holds a life story.
Insurance processes some of the most sensitive personal data in India — health records for underwriting, claim investigation data shared with third-party investigators, motor accident reports, life insurance nominee data. The tension between IRDAI data retention mandates and DPDPA erasure rights mirrors the banking sector conflict — with no resolution in sight.
- Health and medical records used for underwriting without specific DPDPA consent
- Claim investigation data shared with third-party investigators and surveyors without DPA
- Motor accident reports containing injury details, witness statements, and police FIR data
- Life insurance nominee and beneficiary data processed without independent consent
- Actuarial profiling using personal health data without declared DPDPA purpose
→ Medical data used for actuarial profiling requires specific consent. General policy consent does not cover algorithmic health scoring. Section 6(1).
No DPA with investigators. No consent for onward sharing. Each agency is a separate DPDPA liability point.
Location. Call records.
Browsing history.
Telecom holds everything.
Telecom operators hold the most granular personal data of any sector in India — real-time location, call patterns, and browsing history for over a billion subscribers. DPDPA's obligations sit directly in tension with TRAI and DoT data retention mandates.
- Call detail records and location data retained under TRAI mandates vs DPDPA erasure rights
- Subscriber KYC and biometric onboarding data without purpose-limited retention
- SIM swap fraud creating breach notification obligations under Section 8(6)
- Mobile number portability processes sharing personal data across operators
- Tower company access to subscriber location data for network optimisation
→ No DPDPA exemption for telecom exists. Both obligations apply. Legal architecture is required.
This is a personal data breach under Section 8(6). Notification to DPBI is mandatory.
Clinical data cannot
be erased once
the study is complete.
Pharma faces DPDPA's most operationally impossible obligation — retrospective consent withdrawal by clinical trial participants creates erasure demands that would invalidate completed research. No exemption exists. No rule has been issued.
- Clinical trial participant data — consent, withdrawal rights, and post-trial erasure
- Patient health records accessed for pharmacovigilance without re-consent
- Adverse drug reaction data containing personal health information shared with regulators
- Medical representative personal data in sales force management systems
- Distributor and stockist personal data without lawful basis
→ Erasing trial data post-study invalidates the research integrity. DPDPA has no carve-out. Legal architecture is the only solution.
Mandatory CDSCO reporting vs DPDPA data minimisation. Both apply. Neither yields.
Passport copies.
Dietary restrictions.
Guest preferences. All personal data.
Hotels collect government IDs under legal mandate but retain them far beyond check-out. Loyalty programmes build detailed personal profiles across stays. Dietary restrictions constitute sensitive health data. DPDPA covers all of it.
- Passport and government ID copies stored beyond statutory check-out requirement
- Loyalty programme data shared with affiliate hotels and travel partners
- Food allergy and dietary restriction data as sensitive personal health information
- Guest feedback and review data used for profiling without declared purpose
- Event and wedding data containing extensive third-party personal information
→ Retention beyond the check-out purpose violates Section 8(7). Industry practice is not a statutory defence.
No consent for cross-property sharing. No DPA with affiliates. Full fiduciary liability on the primary hotel.
The vehicle is now
a data collection
device on wheels.
Connected vehicles process real-time location, driving behaviour, fuel consumption, and in-cabin audio data. The OEM is a Data Fiduciary for every Indian driver — regardless of where their servers are located. DPDPA applies extraterritorially.
- Vehicle telematics and real-time GPS location data transmitted to OEM servers
- Driving behaviour scores shared with insurance partners for dynamic pricing
- Customer test drive data collected and retained post-purchase decision
- Fleet management systems processing driver personal data and route history
- EV charging network data linking vehicle identity to driver location history
→ DPDPA applies to processing of personal data of Indian residents regardless of server location. Section 3.
Specific consent required. Not covered by vehicle purchase agreement. DPDPA Section 6(1) applies.
The algorithm is the product.
The algorithm runs on
your personal data.
OTT platforms, news apps, and broadcasters build recommendation engines on viewing history, search behaviour, and watch-time data. Under DPDPA, every data point feeding the algorithm requires a declared lawful purpose. Most platforms have none documented.
- Viewing history and content preference profiling without explicit purpose declaration
- Behavioural targeting advertising using personal data without specific consent
- Children's content consumption data processed without parental consent
- News app reader profiling shared with political advertising partners
- Subscriber payment data retained beyond subscription period
→ Every data point consumed by the algorithm is personal data being processed. Section 2(x). Purpose must be declared.
No parental consent for minor's data. Section 9 violated. Up to ₹200 Crores.
Buyer data flows through
a chain with no
Data Processing Agreements.
Property transactions involve a chain of developers, brokers, co-brokers, and channel partners — all handling the same buyer's personal data. None of them have DPAs with each other. All of them are exposed. DPDPA makes the primary developer the first fiduciary.
- KYC and income documents retained after sale completion without erasure schedule
- Buyer data shared across co-broker and channel partner networks without DPAs
- PropTech CRM platforms processing buyer personal data without lawful basis
- Tenant and rental agreement personal data in property management systems
- Real estate investment personal data shared with REIT fund managers
→ Every entity in the chain that received buyer data is a Data Fiduciary or Processor. DPDPA obligations flow through the chain.
Purpose ended at registration. Retention since then violates Section 8(7).
Passenger manifests.
Customs declarations.
All statutory conflicts with DPDPA.
Aviation operates under DGCA and customs regulations mandating passenger data retention for 5 years. DPDPA grants erasure rights. No exemption has been issued. The conflict is live — and airlines must navigate it without a safe harbour.
- Passenger Name Records retained for 5 years under DGCA vs DPDPA erasure rights
- Customs and immigration declaration data shared with multiple government agencies
- Frequent flyer programme data shared with hotel and car rental partners
- Cargo consignee personal data retained in logistics systems beyond delivery
- Courier and last-mile delivery address data shared across sub-contractor networks
→ No DPDPA exemption for DGCA retention exists. Both obligations apply simultaneously. Legal architecture required.
No DPA in the chain. No purpose limitation. Primary courier is the liable Data Fiduciary.
Farmer data. Rural consent.
The most vulnerable
data principals in India.
Agritech platforms and rural FMCG distribution networks process data from India's most vulnerable data principals — farmers and rural consumers who may lack digital literacy, making informed and meaningful consent structurally impossible without vernacular-language mechanisms.
- Farmer income, land record, and crop data on digital lending and insurance platforms
- Rural consumer profiling without meaningful vernacular-language consent
- Crop insurance claim data shared with reinsurers without data sharing agreements
- FMCG distributor and retailer personal data in sales force automation systems
- Agricultural IoT sensor data linking land identity to individual farmers
→ Consent must be informed. A farmer with limited digital literacy clicking a button in English is not informed consent. Section 6(1) requires more.
No farmer consent for onward sharing. Each share is a separate DPDPA violation.
The player is a minor.
The data is real.
The consent is absent.
India's online gaming sector processes children's data at scale — age verification gaps, in-app purchase behavioural profiling, real-money gaming KYC. Section 9 (children's data) and Section 6 (consent for behavioural targeting) create acute exposure that most gaming companies have not mapped.
- Minors using parents’ credentials — no verifiable parental consent, no age-gate
- In-app purchase behavioural profiling of users without declared lawful purpose
- Real-money gaming KYC data — Aadhaar, PAN — retained beyond verification purpose
- Player behaviour analytics and addiction pattern data shared with advertisers
- Esports tournament participant data shared across organiser, sponsor, and broadcaster
→ Self-declared age is not verifiable parental consent. A 14-year-old typing "1999" does not satisfy Section 9. DPDPA requires more.
Behavioural profiling without declared purpose. If player is a minor — Section 9 violation. Up to ₹200 Crores.
The resume was submitted
for a job. Not for
perpetual retention.
HR Tech platforms, recruitment portals, and background verification agencies hold resume databases with millions of data principals. Candidate data retained after rejection, employee records shared with payroll processors, and background checks accessing Aadhaar and criminal records — all without DPDPA-compliant architecture.
- Candidate resumes and application data retained indefinitely after rejection — purpose ended
- Background verification accessing Aadhaar, criminal records, and employment history without specific consent
- Employee payroll data shared with third-party processors without Data Processing Agreements
- Performance review and appraisal data used for algorithmic HR decisions
- Exit interview data and separation records retained without statutory basis
→ Purpose was a specific job application. Retention for undefined future use violates Section 8(7). Industry practice is not a DPDPA defence.
No specific consent for each data source. No DPA with verification agency. Full liability on the hiring company.
Eight lakh societies.
Zero DPDPA awareness.
Full statutory obligation.
India has over 8 lakh cooperative societies — housing, credit, dairy, agricultural. They collect member Aadhaar, bank details, family data, share certificates — all on paper registers, basic Excel sheets, or rudimentary software. Zero DPDPA awareness. Full statutory obligation. The most non-compliant data fiduciaries in India by volume.
- Member Aadhaar, PAN, and bank account details collected without any consent mechanism
- Share transfer records containing family and nominee personal data without purpose limitation
- Housing society maintenance records linking flat ownership to personal financial data
- Credit society loan data — income proof, guarantor details — retained indefinitely
- Dairy and agricultural cooperative member data shared with government subsidy portals without DPA
→ DPDPA applies to every entity processing personal data. A housing society collecting Aadhaar copies is a Data Fiduciary. Section 2(i) makes no exception.
No security safeguards. No access controls. No breach detection. Section 8(5) violated before a single digital system is involved.
Beneficiary data is not
a reporting metric.
It is a sacred trust.
NGOs, non-profits, and social sector organisations process data from India’s most vulnerable populations — children in welfare programmes, disaster relief beneficiaries, health intervention patients. Many share this data with international funders without DPAs, creating cross-border exposure under both DPDPA and FCRA.
- Beneficiary health data, income records, and family information collected without informed consent
- Child welfare programme data — names, photographs, school records — shared in donor reports
- Disaster relief data containing Aadhaar, location, and medical condition shared across multiple agencies
- International funder reporting containing personal data transferred cross-border without DPDPA compliance
- Volunteer and donor personal data used for fundraising without declared purpose
→ Beneficiary photographs and personal stories are personal data. Sharing without specific consent violates Section 6. Cross-border transfer to foreign donors adds Section 16 exposure.
FCRA mandates reporting. DPDPA restricts cross-border transfer. No exemption issued. Dual compliance required.
Smart meters read more
than consumption.
They read behaviour.
Smart meters, prepaid electricity systems, and renewable energy platforms collect granular consumption data that reveals household occupancy patterns, daily routines, and appliance usage. State electricity boards hold millions of Aadhaar-linked consumer accounts. DPDPA applies to every unit of data — not just every unit of power.
- Smart meter data revealing household occupancy patterns and daily routines
- Aadhaar-linked consumer accounts in state electricity board databases
- Prepaid meter recharge data containing payment and location information
- Rooftop solar customer data shared with grid operators and subsidy portals
- EV charging station data linking vehicle identity to driver location and payment
→ Consumption patterns linked to a household identity reveal occupancy, routine, and lifestyle. This is personal data under DPDPA. Section 2(t) defines it broadly.
No DPA between agencies. No consent for multi-agency sharing. Each share is a separate DPDPA event.
Your heart rate.
Your weight. Your sleep.
All personal data.
Gym chains, fitness apps, and wellness platforms process biometric and health data at scale — heart rate, body composition, sleep patterns, calorie intake. Wearable integrations transmit real-time health data to servers that most users never consented to. DPDPA treats every health metric as personal data with full statutory obligations.
- Biometric data — heart rate, body composition, VO2 max — collected via wearable integration
- Health and fitness goals containing medical conditions and dietary restrictions
- Membership data including payment information, attendance patterns, and personal training records
- Wearable device data transmitted to third-party servers without explicit user consent
- Gym CCTV footage containing identifiable members in workout settings
→ App terms covering general use do not constitute specific consent for real-time health data transmission to third-party servers. Section 6(1) requires informed, specific consent.
This is health data. Shared with a nutrition partner for marketing. No specific consent. No DPA. Full DPDPA exposure.
Shared space.
Shared access.
Shared liability.
Coworking spaces and managed offices process visitor logs, biometric access records, CCTV footage, and tenant company employee data flowing through shared infrastructure. The coworking operator becomes a Data Fiduciary for every individual who walks through the door — their own tenants, visiting clients, delivery personnel, and event attendees.
- Visitor registration collecting government ID, photograph, and contact data at reception
- Biometric access systems — fingerprint, facial recognition — for shared office entry
- CCTV surveillance across common areas capturing all occupants without individual consent
- Tenant company employee data flowing through shared Wi-Fi, printers, and access systems
- Event and conference attendee data collected for access but retained for marketing
→ The coworking operator processes biometric access data, CCTV footage, and visitor logs for all occupants. You are the Data Fiduciary for that processing. Section 2(i).
Purpose was building access. Marketing is a separate purpose. Retention for 3 years has no statutory basis. Two DPDPA violations in one visitor entry.
Every sector.
One law. Different stakes.
The obligation under DPDPA is uniform. The exposure is not. Click any sector to see specific risk terrain, unique legal challenges, and maximum penalty exposure.
Every loan, UPI transaction, and insurance claim is a consent event under DPDPA.
- KYC data retained beyond onboarding purpose
- Credit profiles shared with co-lending partners
- Recovery agent data transfer liability
- Third-party payment SDK responsibility
A diagnosis shared without consent is not negligence under DPDPA — it is a statutory breach.
- Patient records shared with insurers without fresh consent
- Telemedicine platforms without consent architecture
- Health data sold to pharma for research
- Wearable and wellness app data flows
The factory floor is now a data compliance zone — biometrics, IoT, and vendor records all covered.
- Worker biometric attendance data without consent
- Vendor and contractor personal records
- CCTV footage retained beyond operational purpose
- IoT wearable monitoring of employees
Growth built on non-compliant data is a liability, not a moat. Investors are asking.
- App onboarding consent not specific or informed
- Third-party SDK data responsibility
- Series funding due diligence readiness
- User retargeting purpose misalignment
DPDPA has no SME exemption. A 15-employee shop with a customer database has full obligations.
- Customer data in WhatsApp groups and Excel sheets
- Employee Aadhaar and medical leave records
- Vendor contact data without lawful basis
- CCTV footage without retention schedule
Service firms carry direct DPDPA obligations as Data Processors. The principal’s liability does not erase yours.
- Client personal data retained post-engagement
- HR outsourcing payroll and medical data
- BPO customer processing without valid DPA
- Call centre agent access to sensitive records
Every learner is a data principal. DPDPA treats minors with zero tolerance.
- EdTech minor data without verifiable parental consent
- Alumni databases for fundraising campaigns
- Behavioural analytics on learners under 18
- Exam data shared with third-party assessors
Every cart, every delivery, every review is personal data. The data trail never ends.
- Purchase history profiling without declared purpose
- Third-party seller access to buyer data
- Abandoned cart retargeting without re-consent
- Delivery partner data sharing without DPA
Banking holds India's deepest personal financial data — and DPDPA's most precise obligations.
- Account data shared with credit bureaus and co-lenders
- Nomination and beneficiary personal data
- Safe deposit locker and vault access records
- Loan recovery communication with third parties
Telecom operators hold location, call, and browsing data for millions — the most granular personal data in India.
- Call detail records and location data retention
- TRAI-mandated data sharing vs DPDPA purpose limits
- Subscriber KYC and biometric onboarding
- SIM swap fraud creating breach liability
Clinical trial data, patient health records, and research participant consent — all now under DPDPA.
- Clinical trial participant data consent and withdrawal
- Patient health records used for R&D without re-consent
- Distributor and MR personal data management
- Adverse drug reaction reporting with patient data
Guest profiles, passport copies, dietary restrictions, and loyalty data — all personal data under DPDPA.
- Passport and ID copies stored beyond check-out
- Guest preference profiles shared with affiliates
- Event attendee data used for future marketing
- Food preference data as sensitive health data
Connected vehicles, GPS tracking, and customer test drive data — the automobile sector's data footprint is expanding rapidly.
- Vehicle telematics and real-time location data
- Customer test drive data retained post-purchase
- Service record data shared with insurance partners
- Fleet management driver monitoring and behaviour data
Viewing habits, search history, and subscriber profiles — OTT platforms hold behavioural gold mines with DPDPA liability.
- Viewing history and content preference profiling
- Subscriber payment data and renewal automation
- Targeted advertising using behavioural data
- Children's content consumption without parental consent
Property buyers share income statements, PAN, Aadhaar, and family data during purchase — all personal data.
- KYC and income data retained after sale completion
- Buyer data shared with co-brokers and channel partners
- Property management tenant data and access records
- PropTech platform data sold to financial service partners
Passenger manifests, customs declarations, and delivery address databases — aviation and logistics hold deeply personal data at scale.
- Passenger PNR and travel history retention
- Cargo and customs declaration personal data
- Delivery address and contact data across courier chains
- Driver and field staff biometric check-in systems
Farmer data, land records, crop insurance information — Agritech is processing some of India's most vulnerable data principals.
- Farmer income and land data on digital platforms
- Rural consumer profiling without meaningful consent
- Crop insurance claim data shared with reinsurers
- Distribution network and retailer personal data
Insurance underwrites risk using deeply personal data — medical histories, genetic predispositions, income, lifestyle habits, and family structures.
- Medical underwriting data retained indefinitely post-rejection
- Claims investigation accessing third-party hospital records
- Nominee and beneficiary data processed without their consent
- Agent networks sharing policyholder data across insurers
Gaming platforms process player behavioural data, spending patterns, location, device identifiers, and — for minors — data requiring verifiable parental consent under DPDPA.
- Minor player data processed without verifiable parental consent
- In-game purchase and spending pattern profiling
- Behavioural tracking and engagement manipulation algorithms
- Cross-border data transfers to foreign game publishers
HR Tech platforms process the most intimate employment data — salary slips, performance reviews, medical leave records, background checks, and biometric attendance.
- Candidate data retained years after rejection
- Background verification accessing criminal and credit records
- Employee health data in wellness programmes without consent
- Exit interview data repurposed for organisational analytics
Cooperatives hold member financial data, property ownership records, voting histories, and defaulter lists — processing personal data of millions with minimal digital governance.
- Member financial data in digitised ledgers without access controls
- Defaulter lists published without lawful basis
- Property ownership and family data shared with managing agents
- Credit cooperative loan data transferred to recovery agents
NGOs process beneficiary data including health status, caste, religion, disability, and economic vulnerability — the most sensitive categories of personal data imaginable.
- Beneficiary data including caste, religion, and disability status
- Donor PAN and financial data retained beyond statutory periods
- Field survey data collected from vulnerable populations
- Data shared with international funding partners across borders
Energy utilities process household consumption data, smart meter readings, payment histories, and Aadhaar-linked subsidy records — mapping the daily life patterns of every connected household.
- Smart meter data revealing household occupancy and lifestyle patterns
- Aadhaar-linked subsidy and payment records
- Consumer complaint data shared with outsourced call centres
- Renewable energy installation data including property and income details
Fitness platforms and sports organisations process biometric data, health metrics, GPS tracking, body composition, and minor athlete data at unprecedented scale.
- Biometric and body composition data from gym equipment and wearables
- Minor athlete data processed by academies without parental consent
- GPS and location tracking during outdoor fitness activities
- Health metrics shared with insurance and corporate wellness partners
Coworking spaces process visitor logs, biometric access data, CCTV footage, Wi-Fi usage logs, and corporate client employee data — functioning as data processors for hundreds of tenant companies simultaneously.
- Biometric access control data for daily entry and exit
- CCTV footage capturing tenant employees and visitors
- Wi-Fi network logs tracking browsing and device data
- Visitor management systems collecting government ID copies
Why Every Sector Needs
Specialised DPDPA Architecture
DPDPA does not differentiate by sector — but compliance necessarily must. A hospital's consent architecture cannot mirror a fintech's. A gaming platform's child data protocol cannot borrow from manufacturing. The statute is uniform; the implementation is irreducibly sector-specific.
These five pillars are not independent obligations — they are interconnected systems. A consent architecture built without data mapping is incomplete. A breach protocol without evidence packaging is performative. Vendor governance without purpose limitation is contractually hollow. DPDPA compliance is a unified, sector-calibrated system — not a checklist.
PRAMAANA™
Evidence Readiness
Framework
The Data Protection Board does not evaluate your intentions. It evaluates your evidence. PRAMAANA™ builds that evidence — systematically, defensibly, before a breach, not after.
Developed by AMLEGALS from first principles of Indian procedural law. Not adapted from any third-party framework. Original jurisprudential architecture.
Request PRAMAANA™ AssessmentData without consent is not an asset.
It is evidence — waiting to be used against you.
The law does not wait for your
readiness. It waits for your breach.
From exposure to evidence.
PRAMAANA™: the Evidence Readiness Framework for DPDPA 2023. No gaps. No excuses.
Not penalties.
Balance sheet events.
The Data Protection Board does not negotiate. It adjudicates. Know the numbers before your name appears on a notice.
Source: Digital Personal Data Protection Act, 2023 — Schedule I. Penalty amounts are maximums per breach event as determined by the Data Protection Board of India.
The question is not
whether to comply.
The question is when.
The Data Protection Board has quasi-judicial powers. It does not negotiate. The organisations that call us before enforcement are the ones that sleep at night.