AMLEGALS — Strategic Lawyering

Sector Repository

DPDPA Impact Decoded — How the DPDP Act 2023 & Rules 2025 Apply, Sector by Sector

A statute-mapped view of how India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 land in each industry. Every brief traces obligations to the exact Section and Rule, sets out the personal data typically in play, the recurring risks, and the actions that follow.

Act assented 11 August 2023Rules notified 13 November 20258 sector briefs
In short

DPDPA Impact Decoded is a sector-by-sector repository mapping how India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply to eight industries. Each brief traces the obligation to the exact Section and Rule, sets out the personal data typically processed, the recurring compliance risks, and the actions that follow.

The DPDP Act applies wherever digital personal data is processed in India, and to processing outside India that involves offering goods or services to Data Principals in India.
Core obligations are common across sectors — lawful notice and consent (Sections 5–6), purpose limitation, a valid processor contract under Section 8(2), security safeguards under Section 8(5) read with Rule 6, and breach handling under Section 8(6) read with Rule 7.
Sector context changes how those obligations are met, not whether they apply — the eight briefs decode that difference industry by industry.
Logistics & Supply Chain — DPDPA sector briefSECTOR BRIEF

Impact on Logistics & Supply Chain

Logistics and last-mile operators sit on dense flows of consignee names, addresses, phone numbers and location trails — much of it processed on behalf of e-commerce and enterprise clients as a Data Processor.

Read the brief
Advertising & AdTech — DPDPA sector briefSECTOR BRIEF

Impact on Advertising & AdTech

Advertising and adtech rely on identifiers and behavioural signals that, when linked to an identifiable individual, are personal data — bringing consent, purpose limitation and the children’s-advertising bar squarely into scope.

Read the brief
Telemarketing & Tele-calling — DPDPA sector briefSECTOR BRIEF

Impact on Telemarketing & Tele-calling

Outbound tele-calling depends on large contact databases and recorded calls — both of which are personal data requiring a lawful basis, notice and disciplined retention under the Act.

Read the brief
OTT & Digital Media — DPDPA sector briefSECTOR BRIEF

Impact on OTT & Digital Media

OTT and digital-media platforms process subscriber identities, payment references and rich viewing-behaviour data used for recommendations — with distinct duties where profiles belong to children.

Read the brief
Workplace Monitoring & Investigations — DPDPA sector briefSECTOR BRIEF

Impact on Employee Monitoring & Investigations

Employee monitoring, device and communications surveillance and internal investigations all process employee personal data — engaging notice, purpose limitation, security and data-principal rights.

Read the brief
EdTech & Online Learning — DPDPA sector briefSECTOR BRIEF

Impact on EdTech & Online Learning

EdTech platforms routinely process the personal data of learners who are children — placing verifiable parental consent and the prohibition on behavioural monitoring at the centre of compliance.

Read the brief
SaaS & Cloud (Data Processors) — DPDPA sector briefSECTOR BRIEF

Impact on SaaS & Cloud Processors

SaaS and cloud providers typically process personal data on behalf of customers as Data Processors — a role defined by the Section 8(2) contract, strong security and breach-support duties.

Read the brief
Retail & Loyalty Programmes — DPDPA sector briefSECTOR BRIEF

Impact on Retail & Loyalty Programmes

Retail and loyalty programmes build detailed member profiles from enrolment and purchase history — used for marketing and personalisation, all of which turn on notice, consent and purpose limitation.

Read the brief

Frequently asked questions

What is DPDPA Impact Decoded?

It is a repository of sector briefs that map the DPDP Act, 2023 and DPDP Rules, 2025 to specific industries. Each brief explains when the Act applies to that sector, the personal data typically processed, the mapped Section and Rule obligations, the recurring risks, and the practical actions.

Which sectors are covered?

Eight sectors: logistics and supply chain, advertising and adtech, telemarketing and tele-calling, OTT and digital media, workplace monitoring and investigations, edtech and online learning, SaaS and cloud data processors, and retail and loyalty programmes.

When does the DPDP Act apply to my sector?

The DPDP Act, 2023 applies whenever digital personal data is processed in India. It also applies to processing outside India where that processing is in connection with offering goods or services to Data Principals in India. If your sector handles customer, employee or user data digitally, it is in scope.

Do the same obligations apply to every sector?

The core obligations are common — notice and consent under Sections 5 and 6, purpose limitation, a valid processor contract under Section 8(2), security safeguards under Section 8(5) read with Rule 6, and breach handling under Section 8(6) read with Rule 7. What changes by sector is the factual context in which those obligations are discharged.

These briefs are general legal information on the DPDP Act, 2023 and the DPDP Rules, 2025, not legal advice. How the law applies turns on the facts of each engagement.

DPDPA sector impact: questions and answers

What is the legal framework for data protection in India?

India's framework is the Digital Personal Data Protection Act, 2023 (Presidential assent 11 August 2023; 44 sections) read with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 (G.S.R. 846(E)) with 23 Rules and 7 Schedules.

What makes consent valid under DPDPA?

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to personal data necessary for the specified purpose. Withdrawal must be as easy as giving consent.

What are the personal data breach notification timelines under the DPDP Rules, 2025?

On becoming aware of a personal data breach, a Data Fiduciary must (1) intimate each affected Data Principal without delay, (2) give the Data Protection Board an initial description without delay, and (3) furnish the Board with updated and detailed information within 72 hours — or such longer period as the Board may allow on request. There is no blanket 72-hour deadline for notifying Data Principals.

Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to DPDPA sector impact?

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).

Who advises businesses on DPDPA sector impact under India's DPDPA?

AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on DPDPA sector impact under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].

What should I send AMLEGALS to get a scoped proposal on DPDPA sector impact?

Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for DPDPA sector impact rather than a generic checklist.

How do I get a first view of my DPDPA exposure on DPDPA sector impact?

Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.

Contact AMLEGALS about DPDPA sector impact · DPDPA Exposure Assessment