DPDP by industry
State instrumentalities carry exemptions in some directions and heightened scrutiny in others. The practical question is rarely whether an exemption applies — it is whether the body can evidence which one it relied on, and when.
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 7, 17
Processing for subsidies, benefits, services, certificates, licences and permits is a listed legitimate use. Relying on it without recording the basis per activity turns a lawful position into an undocumented gap at inquiry.
Sec. 10(2)(c)(iii)
Automated decisioning that affects entitlement carries the heaviest justification burden. Model purpose, training-data provenance, bias testing and human oversight all have to be on record.
Sec. 5
Public-facing services reach citizens who are entitled to notice in any of the twenty-two Eighth Schedule languages. Serving English alone is a defect in the notice itself, not a translation backlog.
Sec. 28
The Board may require production of records. For a public body the evidence trail is also the audit trail the CAG and the legislature will ask for.
What closes them
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
Run the whole privacy programme from one control plane, so the next regulation lands as configuration.
Sec. 4, 7, 10, 16
Find and price privacy risk at design time, and keep a defensible assessment record the auditor can read.
Sec. 10(2)
Prove compliance from evidence rather than assert it from policy, at any depth, on demand.
Sec. 10(2)(b)
Replace stale inventories with a live, identity-resolved map of every place personal data actually lives.
Sec. 8(3), 8(7)
Sequence
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
Phase 2
Weeks 4–12
Phase 3
Weeks 8–18
Phase 4
Weeks 14–26
Assurance and audit trails for public institutions deploying AI, with explainable detection output that stands up to oversight.
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.
