Patient health data is classified as sensitive personal data under the DPDP Act — attracting the highest penalty tier and the strictest consent standards. Every OPD visit, teleconsultation, lab result, and prescription record requires lawful, specific, and informed consent before processing or sharing.

ABDM-linked health IDs, telemedicine platforms under NMC guidelines, and pharmaceutical companies running clinical trials all carry specific notice and consent obligations. Breach notification within 72 hours is mandatory, and right-to-erasure requests must be honoured even for historical health records.

EdTech platforms collecting data from users under 18 years old face the strictest obligations under the DPDP Act — verifiable parental consent is mandatory before any data processing. This applies to learning analytics, progress tracking, video completion data, and personalised recommendation engines.

Competitive exam platforms, university admission portals, and school management systems also process sensitive academic and biometric data. Notice must be given in plain language that a minor can understand, and all marketing profiling of minors is explicitly prohibited

E-commerce platforms process some of the richest PII in India — name, phone, address, payment details, purchase history, and browsing behaviour. Cookie consent, marketing opt-ins, and retargeting permissions must all be collected, stored, and honoured with equal-ease withdrawal before the DPDP deadline.

Marketplaces acting as Data Fiduciaries for their sellers also inherit obligations around third-party data sharing. Right-to-erasure requests from customers must delete data across all downstream systems — fulfilment, returns, loyalty, and analytics — within mandated timelines.

SaaS companies occupy a dual role under the DPDP Act: you are a Data Fiduciary for your own users' data, and simultaneously a Data Processor for your customers' end-user data. Both roles carry distinct obligations — and your enterprise buyers will demand DPDP-compliant DPA agreements before signing contracts.

Multi-tenant architectures create unique PII isolation challenges. AI features, usage analytics, and product telemetry that process customer data require mapped consent flows, and any LLM or AI pipeline that receives user data must be Privacy-Guarded to prevent unintended PII leakage in model training or responses.

Telecom operators are among India's largest processors of personal data — handling real-time location, call records, messaging metadata, and subscriber KYC for hundreds of millions of users. TRAI directives increasingly overlap with DPDP obligations, requiring unified consent management across voice, data, and OTT services.

Call Detail Records (CDRs), tower location data, and IMSI/IMEI identifiers are all personal data under DPDP. Sharing these with government agencies, advertisers, or roaming partners requires specific consent or legitimate use notifications. Breach of subscriber data carries the highest penalty tier under the Act.