DPDP by industry
Group structures multiply every obligation: multiple legal entities, shared services, a common CRM and cross-entity data flows that were never modelled as transfers between separate Fiduciaries.
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 2(i), 4
Shared platforms across group companies make the determining party ambiguous. The Act attaches duties to whoever determines purpose and means, so the answer has to be recorded per processing activity rather than assumed from the org chart.
Sec. 8(3), 11
Moving personal data between group companies is disclosure to another Fiduciary, with the notice and lawful-basis consequences that follow.
Sec. 10
Volume and sensitivity make large groups the most likely candidates for Significant Data Fiduciary notification, which switches on DPO, auditor, DPIA and algorithmic duties on a government timetable rather than yours.
What closes them
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
Run the whole privacy programme from one control plane, so the next regulation lands as configuration.
Sec. 4, 7, 10, 16
Replace stale inventories with a live, identity-resolved map of every place personal data actually lives.
Sec. 8(3), 8(7)
Find and price privacy risk at design time, and keep a defensible assessment record the auditor can read.
Sec. 10(2)
Prove compliance from evidence rather than assert it from policy, at any depth, on demand.
Sec. 10(2)(b)
Receive, verify, fulfil and audit every access, correction, erasure and grievance request inside the statutory clock.
Sec. 11–14
Sequence
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
Phase 2
Weeks 4–12
Phase 3
Weeks 8–18
Phase 4
Weeks 14–26
Enterprise-scale deployment with federated architecture, so trust analytics run without centralising sensitive biometric data.
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.
