DPDP consent, sector by sector.
Every industry collects personal data differently and answers to its own regulator. The DPDP Act 2023 applies to all of them. See where the data comes from, where it goes, and how Promiz handles each case with one record, one rulebook and the same queues.
Last reviewed 18 September 2026
Which industry are you in?
Pick a sector to see its data flow, the hard cases, and how Promiz handles them.
Why is DPDP consent hard in banking?
A bank meets the same customer at a branch counter, in a mobile app, at a call centre and through a relationship manager. Each channel collects personal data under a different mix of consent and legal obligation. RBI record-keeping directions require some of that data to stay for years after an account closes. The DPDP Act asks you to stop processing on withdrawal and erase once a purpose ends. You can only reconcile the two when every purpose carries its own legal basis and retention clock.
Regulators.RBI directions on record retention apply alongside the DPDP Act 2023 and DPDP Rules 2025. Confirm retention periods for each purpose with your legal team.
Four channels write to one record. Each purpose carries its own legal basis and retention clock.
Why is DPDP consent hard in NBFC lending?
Lending runs on a chain of processors: sourcing partners, bureaus, KYC vendors, co-lenders and collection agencies. Borrower data leaves your systems on day one. A withdrawal is only complete when every processor has stopped too. Digital lending journeys also collect consent fast, on a phone, often in a regional language. Proof of the notice shown is harder to keep than the signature.
Regulators.RBI digital lending and outsourcing directions apply alongside the DPDP Act 2023 and DPDP Rules 2025. Confirm your processor obligations with your legal team.
Borrower consent reaches every processor through signed webhooks.
Why is DPDP consent hard in insurance?
Insurers collect some of the most sensitive personal data in the market: health history, family details, income and nominee information. Agents and brokers gather much of it on paper or over a phone, long before the customer uses a portal. When a customer later asks what they agreed to, the proposal form rarely shows the notice that was read out. Quotes, underwriting, claims and marketing are often bundled under one signature.
Regulators.IRDAI regulations on policyholder data and outsourcing apply alongside the DPDP Act 2023 and DPDP Rules 2025. Confirm sector requirements with your legal team.
Offline customers accept the notice themselves through a single-use email link. Each record keeps a snapshot of what they saw.
Why is DPDP consent hard in healthcare?
Hospitals, clinics, labs and digital health apps hold records that clinicians must reach in an emergency. The same systems hold data used only for research, wellness programmes or marketing. Patients include minors and people who cannot consent for themselves. A single withdraw-everything switch is unsafe for care. A single keep-everything policy is unlawful for the rest.
Regulators.The DPDP Act 2023 and DPDP Rules 2025 apply, with the children’s data provisions (S. 9, Rule 10). Confirm any sector-specific record-keeping duties with your legal team.
Each purpose has its own legal basis and retention period. Guardians of minors are verified through DigiLocker.
Why is DPDP consent hard in e-commerce and retail?
Retail sites change all the time: a new ad pixel, an A/B testing script, a chat widget, a payments SDK. Each one can set cookies and read personal data before compliance hears about it. Shoppers arrive from every state and expect a notice they can read. Marketing teams need consent that survives the next campaign tool.
Regulators.The DPDP Act 2023 and DPDP Rules 2025 apply to online and offline retail data. Confirm consumer-protection overlaps with your legal team.
Every tag stays blocked until the shopper allows its purpose. The scanner re-crawls the site on a schedule.
Why is DPDP consent hard in education and ed-tech?
Schools, coaching platforms and ed-tech apps process data about learners who are mostly under 18. The DPDP Act requires verifiable parental consent for a child’s data. It bans tracking, behavioural monitoring and targeted advertising directed at children, with narrow exemptions in the Fourth Schedule. Product analytics that is routine for adults becomes a compliance question here.
Regulators.DPDP Act 2023 S. 9 and DPDP Rules 2025 Rule 10, Rule 12 and the Fourth Schedule govern children’s data. Confirm which exemptions apply to you with your legal team.
A guardian is verified as an adult through DigiLocker before consent is recorded for the child.
Why is DPDP consent hard in travel and hospitality?
A single stay creates data at the online travel agent, the booking engine, the front desk, the loyalty programme and often a third-party check-in kiosk. Staff collect passport and ID scans at the desk and rarely tie them to a consent record. When a guest asks for erasure, most properties cannot say where all the copies are.
Regulators.The DPDP Act 2023 and DPDP Rules 2025 apply to guest data. Confirm identity-document retention rules with your legal team.
Web, forms and front-desk capture all write to one record, so every channel sees the same status.
Why is DPDP consent hard for SaaS and technology companies?
A software company is a Data Fiduciary for its own users and a Data Processor for the personal data its customers load into the product. Rights requests arrive in both roles. Engineering must wire consent into sign-up flows, settings pages and back-end jobs without building a compliance system from scratch.
Regulators.The DPDP Act 2023 and DPDP Rules 2025 apply to you as a Data Fiduciary for your own users, and through contracts as a Processor. Confirm your processor terms with your legal team.
Your back end records consent, checks status and receives withdrawal events through the REST API or Python SDK.
Promiz works for any Data Fiduciary that collects personal data in digital form.
Bring one purpose. Leave with the proof.
A 30-minute session on your own use case.
- 5 min Find your DPDP gaps for that purpose
- 20 min Build the notice, collect consent, withdraw it, and close the task
- 5 min Download the receipt and verify the chain