Skip to main content

Step 11 - Compliance Checklists by Industry

Step 11: Compliance Checklists by Industry​

While the Digital Personal Data Protection Act (DPDPA), 2023 applies to all organizations, the risks and requirements differ depending on the industry. Each sector handles unique categories of personal data — financial, health, identity, behavioral — and therefore needs tailored compliance steps.

1. Banking and Financial Services​

Data Handled: KYC documents, account details, transaction histories, credit scores.

Checklist:

  • Encrypt all sensitive data (Aadhaar, PAN, bank accounts).
  • Retain KYC data only for the RBI-mandated period (10 years after account closure).
  • Appoint a Grievance Officer; large banks will likely qualify as SDFs and must appoint a DPO.
  • Test and document breach response plans to meet the 72-hour reporting deadline.
  • Audit third-party vendors (credit bureaus, payment gateways) for DPDPA compliance.
Tip

Create a customer rights portal where account holders can request access, correction, or closure of their data.

2. Insurance​

Data Handled: Health records, claims history, Aadhaar, nominee details.

Checklist:

  • Limit collection of health records only to what is necessary for claims.
  • Update privacy notices on claim portals and apps.
  • Maintain secure, encrypted storage for medical reports.
  • Create a mechanism to honor withdrawal of consent for marketing communications.
  • Conduct DPIAs before deploying AI/ML claim approval systems.
Tip

Maintain a breach notification template ready for immediate dispatch to policyholders if sensitive health data is exposed.

3. Healthcare and Pharmaceuticals​

Data Handled: Patient health records, diagnostic reports, genetic and biometric data, clinical trial data.

Checklist:

  • Implement strict access controls (doctors only, need-to-know basis).
  • Encrypt medical histories and diagnostic reports.
  • Anonymise or pseudonymise data used for research and trials.
  • Retain data only as long as medically or legally necessary.
  • Train staff to recognize sensitive data breaches (e.g., accidental disclosures).
Tip

Use a Consent Manager platform when seeking permission from patients for sharing medical data in research projects.

4. E-Commerce and Retail​

Data Handled: Names, delivery addresses, payment details, browsing and purchase histories.

Checklist:

  • Collect only data needed to complete transactions and deliveries.
  • Delete or anonymise customer addresses after return/warranty periods expire.
  • Provide clear notices when collecting consent for marketing or loyalty programs.
  • Secure payment data under PCI-DSS standards.
  • Audit logistics partners handling delivery information.
Tip

Implement an “unsubscribe with one click” feature in promotional emails to simplify consent withdrawal.

5. Social Media and Tech Platforms​

Data Handled: Photos, messages, posts, browsing activity, children’s data, behavioral data for ads.

Checklist:

  • Obtain verifiable parental consent for users under 18.
  • Provide simple tools for consent withdrawal and account deletion.
  • Publish detailed privacy notices explaining use of algorithms for recommendations/ads.
  • Conduct algorithm fairness reviews to avoid bias.
  • Implement real-time breach monitoring.
Tip

Create an in-app privacy dashboard where users can view, download, or delete their data directly.

6. Stock Broking and Investment​

Data Handled: PAN, Aadhaar, trading histories, income proofs, bank details.

Checklist:

  • Retain financial data only as required by SEBI (usually 7 years).
  • Encrypt and secure transaction records.
  • Notify clients immediately in case of a breach.
  • Limit sharing of trading data with third-party analytics providers.
  • Conduct periodic third-party security audits.
Tip

Establish a dedicated helpline and email (e.g., privacy@broker.com) for investors to request corrections or lodge complaints about data handling.

7. Crypto Exchanges​

Data Handled: KYC details, wallet addresses, trading activity, linked bank accounts.

Checklist:

  • Conduct strict due diligence on third-party wallet and KYC providers.
  • Disclose if user data is processed on foreign servers.
  • Encrypt wallet keys and trading logs.
  • Notify users and the Board within 72 hours of any breach.
  • Maintain records of cross-border transfers for audit.
Tip

Use multi-factor authentication (MFA) as a mandatory safeguard for user accounts and store KYC data separately from trading logs.

Why Industry-Specific Checklists Matter​

The same law applies differently depending on the type of data and risks involved. A hospital leaking genetic test results is far more damaging than a retailer losing a phone number. Tailored checklists help organizations focus on the highest-risk areas in their sector and implement compliance efficiently.