InfraVeritas360DPDPiq

DPDP Insights › The law › Section 6

What it means in your sector

• Banking, financial services and insurance: Cross-selling, sharing with partner insurers or fund houses, and marketing calls need specific consent. An account-terms clause will not do.
• IT, ITeS, BPO and GCC: Marketing to prospects and optional employee programmes need proper consent.
• Healthcare and hospitals: Sharing with insurers or researchers, health camps and marketing of health packages need proper consent.

Questions where this section matters

• What should our privacy notice say, and where must people see it?
• When do we need consent, and when can we rely on a legitimate use?
• Someone withdraws consent. What has to stop, and how fast?
• Do we process children's data, and what changes if we do?
• Can we send offers to past customers and leads?
• Can we cross-sell insurance, cards or mutual funds to existing customers?
• What can collection agents do with borrower data?
• What can our lending or banking app collect from a phone?
• How long can we keep candidate data?
• What about distributors, dealers and franchisees?
• Do we need DPDP consent to treat a patient?
• Can we use patient data for research, audits or case studies?
• We are linked to ABDM. How does its consent fit with DPDP?

Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.