Digital Personal Data Protection Act

The DPDPA 2025 rules are set to redefine how the automotive and EV ecosystem approaches data. With vehicles becoming software-driven and connected, data flows across R&D, manufacturing, dealer networks, and customer interfaces are now central to business models. These regulations elevate data governance from a compliance checkbox to a strategic lever—demanding privacy-by-design in telematics, predictive maintenance, and mobility services. For industry players, this means embedding trust and transparency into every digital touchpoint, ensuring global interoperability while mitigating risks. Those who act proactively will not only safeguard against steep penalties but also unlock competitive advantage by building resilient, customer-centric data architectures that power innovation in the era of electrification and autonomy.

Saket Mehra
Partner and Auto & EV Industry Leader​, Grant Thornton Bharat

The November 2025 DPDPA Rules impose comprehensive obligations on aviation stakeholders, requiring airlines, airports, and aerospace manufacturers to implement consent-based passenger data systems, embed privacy-by-design into biometric and IoT platforms, and ensure compliance across complex vendor networks. While these measures will inevitably increase expenditure on IT infrastructure, cybersecurity, and governance, they are indispensable for safeguarding sensitive information and sustaining international confidence in an industry which is known to attract and manage massive volume of personal data of travelers and other stakeholders.

Ashish Chhawchharia
Partner and Aviation Industry Leader, Grant Thornton Bharat

DPDP Act and Rules are reshaping the consumer and retail landscape, especially digital commerce, by making privacy the cornerstone of customer experience. Businesses can no longer rely on unchecked personalisation; every data point now demands explicit consent and secure handling. This shift impacts everything, from consent management at scale to cross-border data flows and vendor compliance. For e-commerce players, the implications are profound: balancing frictionless shopping with robust privacy controls will define winners and losers. Those who embrace transparency and embed privacy into their brand promise will not only avoid penalties but also earn the ultimate competitive edge, which is consumer trust.

Naveen Malpani
Partner and Consumer Industry Leader​, Grant Thornton Bharat

India’s DPDP Act marks a turning point for the energy and infrastructure sectors where data-driven operations across utilities, renewables, transport and carbon markets must now be anchored in strong consent, secure governance and clear accountability. By embedding privacy-by-design into workflows, deal pipelines and ESG reporting, organisations can not only meet regulatory expectations but also strengthen trust, reduce risk and enhance the credibility of their climate disclosures emerging as transparent, resilient and future-ready leaders.

Amit Kumar
Partner and Energy & Renewables Industry Leader, Grant Thornton Bharat

With the release of the DPDPA Rules in November 2025, manufacturers must now implement strict consent-based data collection, anonymisation of worker and IoT data, and enhanced cybersecurity across supply chains. These requirements should be regarded by manufacturers as a strategic imperative and will result in reduced costs in the long term and positioning as competitive and trusted partners in global trade.

Shridhar Kamath
Partner and Engineering & Industrial Products Industry Leader, Grant Thornton Bharat

Digital Personal Data Protection Act (DPDA) presents the business opportunity to further enhance the trust for banking and financial services to the customers by protecting personal data adequately as per DPDP rules, the implementation of rules should be based on three pronged principles as spreading awareness at each level, Assessing Readiness Gaps, if any, at each process and Implementation of Rules along with testing from independent agency(ies).

Dharmendra Jhamb
Partner and Fintech Industry Leader, Grant Thornton Bharat

India’s DPDP regime is encouraging healthcare organisations to treat patient data with the same care as medical treatment. From electronic health records and diagnostic images to teleconsultations and connected devices, personal data across the care continuum now comes with clear responsibilities: taking proper consent, using data only for defined purposes, and keeping it secure. This is not just about compliance; it’s about building a privacy-first culture that earns long-term patient trust. The shift also impacts interoperability networks and public health programmes, ensuring consistent practices across care delivery and data exchange. Over time, these safeguards will lay the foundation for responsible AI adoption and integrated care models. They will support the creation of a connected, patient-centric healthcare system rooted in affordability, accessibility, and availability, while enhancing provider competitiveness and India’s standing as a trusted medical tourism destination.

Bhanu Prakash Kalmath
Partner and Healthcare Industry Leader, Grant Thornton Bharat

Given insurers’ and insurtechs’ heavy reliance on sensitive customer data, the DPDPA’s applicability becomes significantly important. Alongside the IRDAI Cybersecurity Guidelines 2023, which converge on key elements of data privacy, security and accountability, the Act is reshaping how data is collected, used and protected by insurance companies. Together, these regulations are driving stronger governance and privacy-first practices, ultimately deepening customer trust.

Narendra Ganpule
Partner and Insurance Industry Leader, Grant Thornton Bharat

In media and entertainment, the Digital Personal Data Protection Act directly impacts how audience profiling, targeted advertising, and content recommendation engines operate. As platforms balance personalisation with privacy-especially around children’s data and cross-platform tracking-DPDPA pushes the industry to redesign data practices that protect trust without limiting creative and commercial innovation.

Ananay Jain
Partner, Grant Thornton Bharat

Devices today are not just hardware, they are data engines, streaming insights from implants, monitors, wearables, and AI-driven diagnostics. With DPDP, the expectation shifts: privacy must be engineered into every layer of the device ecosystem, from design to deployment. For manufacturers and global OEMs, this means moving beyond compliance checklists to privacy-by-design principles, clear consent flows, minimal data collection, encrypted pipelines, and lifecycle governance. Done right, this isn’t a burden, it’s a differentiator. DPDP turns data protection into a lever for responsible scale, interoperability, and sustainable growth in India’s medtech market.

Abhay Anand 
Partner, Deals Lifecycle, Grant Thornton Bharat

The DPDP Act and new rules mark a critical shift for the metals and mining sector. While the government is working on greater data transparency, the sector will need to balance its data sharing commitments with protection of privacy. The sector is unique in that it hires land-losers in large numbers where their entitlements are dependent on the evidence they share against their claims. In the last several years, this sector has seen operations being handed out widely to contract workers. A lot of compassionate hiring happens on account of the hazardous nature of the sector. Most metal and mining companies provide accommodation in remote location to families of employees. They provide municipal services. Due to the large operational footprint of metals and mining companies they typically extend CSR related initiatives beyond their plant-gate and township. Needless to say, they manage not just employee-data but also citizen-data. The new DPDP Act needs to be taken seriously by the metals and mining sector and managed through strong compliances so that investor, employee, and business partner confidence is maintained.

Niladri Bhattacharjee
Partner and Metals & Mining Industry Leader, Grant Thornton Bharat

Data has always been the key pillar for business growth, be it in form of revenue, operational excellence or customer experience. Hence, privacy has always been one of the most imperative drivers for data governance. While financial services organisations have always factored this into account in their data governance journey, DPDPA guidelines empower the governance functions to formally implement this with rigour. While not explicitly called out yet, it would be useful for financial services organisations to assume that they will be significant data fiduciaries and implement DPDPA.

Vivek Iyer
Partner and Fintech Industry Leader, Grant Thornton Bharat

The DPDP Act is reshaping India’s Real Estate and REIT sector as it scales digital platforms across construction, operations, and investor engagement. With customer data embedded in access systems, leasing platforms, and engagement apps, the Act demands stronger consent management, data minimisation, secure sharing, and clear accountability. Early adoption of privacy-by-design will reduce cyber and compliance risk while reinforcing trust with customers, tenants, and investors.

Shabala Shinde
Partner and Real Estate Industry Leader, Grant Thornton Bharat

In sport today, data is at the heart of every major decision, from fan engagement to athlete management to sports infrastructure. The DPDP framework puts this on firm ground by setting clear rules for consent, purpose limitation, data minimisation and security by design whenever health, biometric or behavioural data is used. Getting privacy right is now a competitive advantage, especially for our sports industry: it builds fan trust, safeguards athletes and underpins sustainable performance and commercial value across our sporting ecosystem.

Arjun Singh
Partner and Sports Industry Leader​, Grant Thornton Bharat

The DPDPA is reshaping the technology industry from compliance-by-design to trust-by-design. With clearer rules on consent, retention and breach response, businesses now need stronger data governance and sharper engineering discipline. Firms that treat this as a trust advantage—not a cost—will lead the digital economy.

Raja Lahiri
Partner and Technology Industry Leader, Grant Thornton Bharat

DPDPR is transforming the transportation and logistics sector by making data privacy cornerstone and integral to operational excellence and business continuity. From real-time tracking to digital proof of delivery, compliance demands secure systems, consent-driven processes, and vendor accountability. This is not just a regulatory shift; it’s a strategic pivot. Businesses that embed privacy into their logistics workflows will not only mitigate risk but also strengthen customer / stakeholders trust, turning compliance into a competitive differentiator in an increasingly data-driven supply chain.

Bhavik Vora
Partner and Transportation & Logistics Industry Leader, Grant Thornton Bharat