The obligations are the same. The order they arrive in is not.
Every business website carries accessibility, privacy, security and data-rights obligations. What changes by sector is which one produces a letter first, and what extra rules sit on top. These are the sectors where that difference is large enough to matter.
A practice website looks like any other business website and is not one. The moment a page relates to a condition, a provider or an appointment, ordinary marketing tools start touching information that is regulated differently from everything else on the internet.
A lead form on a lender or advisor site collects information that is regulated by name. Federal financial privacy rules sit alongside state privacy law, and in California there is a state financial privacy statute that applies regardless of size.
Two things make a law firm site different. Everything on it is subject to professional conduct rules on advertising and solicitation, and an unsolicited message from a prospective client raises duties before anybody has been engaged.
Nonprofits are outside the scope of several state privacy statutes, which is genuinely useful and frequently over-read. Accessibility obligations do not carry that exemption, and funders increasingly ask about both.
A checkout is the highest-consequence accessibility surface a business owns, because a barrier there is a customer who cannot buy. Selling also brings payment card obligations and, if you take subscriptions, disclosure rules about how people cancel.
For a contractor, plumber or roofer, the website exists to produce a phone call. That makes the form and what you do with the number afterwards the part with rules attached, and the service-area pages the part with a search problem attached.
For a consultancy or agency, the website is a credibility surface rather than a transaction one. The obligations arrive sideways, through a client asking you to prove something about it before they sign.
A business with forty location pages has forty pages that must be accessible, forty sets of details that must be accurate, and forty opportunities for a stale phone number to become a complaint. Nothing here is conceptually hard. It is the volume that defeats people.