DPDP is the floor. Your sector adds its own ceiling.
In finance, insurance, education and health, DPDP applies. Sector rules from RBI, SEBI, IRDAI and others apply too. This hub maps how those regimes stack.
How the layers stack
If you handle personal data of people in India, DPDP is your floor. On top of that, sector regulators add their own obligations for the products they oversee.
Read top-down: sector regulators add duties on top of the DPDP baseline. None of these layers replace DPDP.
In this cluster
Each sub-article traces to a primary source. Where the source material did not confirm specifics, items are marked Pending confirmation rather than fabricated.
Finance & Fintech — RBI and SEBI Expectations
Keeping payment data in India, ID-check (KYC) data under two laws, and good-practice AI checks.
ReadSEBI — Cybersecurity Framework and AI Consultation
CSCRF 2024 is binding for SEBI-regulated entities. SEBI's AI-in-markets consultation is not yet a binding rule.
ReadIRDAI — Insurance Data and Cybersecurity Rules
Collect less health data. Get clear consent. Do not reuse it for other products. Pass duties on to IT vendors.
ReadEducation & EdTech
DPDP Section 9: get a parent's proven consent, and do not track children.
ReadHealthcare & Health Tech
Health data: sensitive under SPDI Rules 2011; DPDP has no sensitive category but applies in full.
ReadAm I a Data Fiduciary?
Sector rules sit on top of DPDP, not instead of it. Run the self-check to confirm your baseline DPDP status first.
Run it nowHow does this apply to you?
Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.
Take the DPDP Applicability CheckYour answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.