Sectoral regulatory notices and the DPDP Rules: how SEBI, RBI, NMC and UGC circulars work alongside data protection duties

Across India's regulated industries, statutory authorities issue a steady stream of public notices, circulars, advisories and master directions that tell businesses exactly what personal data, transaction records, call recordings, medical particulars or identity proofs they must collect and keep. In October 2026 alone, the National Dental Commission mandated nine particulars on every dental prescription, the Securities and Exchange Board of India reviewed call-record maintenance rules for institutional research analysts, the National Medical Commission clarified remote digital-signature authentication for medical records, the Reserve Bank of India updated foreign-exchange and loan-reset disclosures, and the University Grants Commission issued cybersecurity directives for higher educational institutions. As the 13 May 2027 enforcement date of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 approaches, compliance teams across every vertical must understand how sectoral regulatory notices and horizontal data protection duties operate side by side.

How sectoral regulatory notices interact with the DPDP Act across industries

The DPDP Act is drafted as a horizontal statute: its provisions operate in addition to, and not in derogation of, any other law for the time being in force in India. Only in the event of a direct conflict between a provision of the DPDP Act and another law does the DPDP Act prevail to the extent of that conflict. In practice, this means that when a sector regulator—such as the Reserve Bank of India, SEBI, IRDAI, the National Medical Commission, the National Dental Commission, TRAI, the University Grants Commission or the Central Consumer Protection Authority—requires a business to collect specific particulars or retain records for a fixed period, that sectoral mandate establishes the lawful scope and retention floor for the regulatory record, while the DPDP Act governs notice transparency, security safeguards, vendor contracts, one-year processing logs and breach reporting.

October 2026 sectoral public notices and circulars mapped to DPDP Rules controls

Looking across the major industry verticals where Indian regulators issued circulars and public notices in October 2026 illustrates how a sectoral notice and the DPDP Rules fit together in daily operations:

Why a mandatory regulatory record is not a blank cheque for marketing

The most common compliance mistake across regulated sectors—whether in a hospital, a stockbroking desk, a cooperative bank, an EdTech institute or an e-commerce marketplace—is assuming that because a regulator mandates collecting a customer's name, mobile number, Aadhaar/PAN or prescription history, the business may freely reuse that same database for promotional WhatsApp broadcasts, cross-selling or third-party sponsor campaigns. Under the DPDP Act, personal data processed for a statutory or regulatory requirement cannot be repurposed for commercial marketing without a standalone, itemised privacy notice and separate, unbundled consent that the individual can withdraw at any time.

Conversely, when a customer or patient withdraws marketing consent or submits an erasure request, the Data Fiduciary must erase the optional marketing profile and cause its Data Processors to erase it, while retaining the specific transaction, tax, call-log or medical records whose retention is necessary for compliance with an Indian law or sectoral circular.

Our view: how to wire sectoral regulatory notices into your DPDP workflow

In our view, legal, compliance and operations teams across banking, healthcare, education, retail, SaaS and corporate services should treat every new sectoral public notice or circular as a direct input to their DPDP governance register through six actions: