Penalty band
Which Schedule 1 cap the sector typically touches — ₹50 cr to ₹250 cr per failure.
DPDP by industry
Which industries the DPDP Act hits hardest — and what each one has to do
The DPDP Act 2023 applies to every Indian Data Fiduciary, but the practical burden is wildly uneven by sector. BFSI, healthtech and edtech sit in the ₹250 cr / ₹200 cr penalty bands with sector-regulator overlays. SaaS and e-commerce face death-by-a-thousand-cuts exposure. We break each industry down — penalty band, required controls, realistic time & budget — so you can plan your sprint against the obligations that actually apply to you.
Ranked by DPDP exposure
Most-exposed Indian industries under the DPDP Act
Risk rank combines data sensitivity, user volume, sector-regulator overlay, and the Schedule 1 penalty band that the industry typically touches.
#1 most exposed
BFSI & Fintech
Highest DPDP exposure of any Indian sector — payment data, KYC, credit profiles all in scope.
Exposure cap
₹250 cr
Effort
160–400 hrs
Open the BFSI / Fintech guide
#2 most exposed
Diagnostic Labs & Pathology Chains
Patient PII + lab results + Aadhaar-linked KYC — the most stacked DPDP exposure of any sub-sector inside healthcare.
Exposure cap
₹250 cr
Effort
180–440 hrs
Open the Diagnostics / Pathology guide
#3 most exposed
Healthtech & Pharma
Health data is the highest-sensitivity category — DPDP overlaps with ABDM and the Clinical Establishments rules.
Exposure cap
₹250 cr
Effort
140–320 hrs
Open the Healthtech / Pharma guide
#4 most exposed
Edtech
Children's data is the headline restriction — verifiable parental consent, no tracking, no targeted ads.
Exposure cap
₹200 cr
Effort
120–280 hrs
Open the Edtech guide
#5 most exposed
E-commerce & D2C
Trackers + checkout PII + post-purchase marketing — the three places DPDP scanners hit hardest.
Exposure cap
₹150 cr
Effort
60–160 hrs
Open the E-commerce / D2C guide
#6 most exposed
SaaS
Joint accountability with your customers — and DPAs to your sub-processors are the bottleneck.
Exposure cap
₹150 cr
Effort
80–200 hrs
Open the SaaS guide
#7 most exposed
Media & Publisher
Ad-tech + analytics + paywall — the trio that DPDP scanners flag fastest on Indian news sites.
Exposure cap
₹50 cr
Effort
60–140 hrs
Open the Media / Publisher guide
#8 most exposed
Government & PSU
Public-sector platforms and PSUs are explicitly in scope — and SDF designation is highly likely.
Exposure cap
₹250 cr
Effort
200–500 hrs
Open the Government / PSU guide
How we ranked
What goes into a sector's DPDP exposure rank
Data sensitivity
Financial, health, biometric and children's data are explicit aggravating factors under Section 33(2).
User volume
The Section 10 SDF trigger and an explicit Section 33(2) gravity factor.
Sector overlay
RBI, IRDAI, MoH&FW, MeitY rules that stack on top of DPDP and cannot be avoided by DPDP "permissive" defaults.