Do sector regulators have their own DPDP-related requirements?

Yes, and this is one of the most commonly missed points. The DPDP Act sets a baseline that applies across every sector, but it does not repeal or override the data and cybersecurity rules that individual regulators already enforce. Those continue to operate alongside it, and are frequently stricter.

In financial services, the RBI issued Advisory No. 3/2026 dated 25 March 2026, through its Department of Supervision, on best practices for customer data protection, drawing on a thematic study across supervised entities. It sits on top of existing RBI frameworks including the Master Directions on IT Governance, the Digital Lending Guidelines and payment data localisation requirements. In healthcare, NABH and the CDSCO have issued the guidance described elsewhere in these FAQs.

The practical consequence is that compliance is rarely a single exercise. An organisation needs to know both what the Act requires and what its own regulator requires, and to reconcile the two where they pull in different directions, most often on retention and breach reporting timelines.