Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).
DPDP compliance for SaaS companies turns on one question: for each set of personal data you touch, are you the data fiduciary or the data processor? For customer data loaded into your platform you are almost always a processor, which means you act only under a valid contract with your customer and the customer remains legally answerable to the Data Protection Board. For your own users, prospects and employees you are the fiduciary with the full set of Section 5 to Section 8 duties. This guide covers the test, the processor-side DPA, sub-processor management and the DPDP questionnaires enterprise customers are already sending ahead of the May 2027 enforcement date.
Are you a data processor under DPDP Act or a data fiduciary?
A data fiduciary determines the purpose and means of processing; a data processor processes on the fiduciary’s behalf. The Act attaches nearly every substantive obligation (notice, consent, safeguards, breach notification, rights, erasure) to the fiduciary. The processor appears mainly in Section 8: a fiduciary may engage one “only under a valid contract”, and remains responsible for compliance regardless of that contract.
The practical test
In our reading, three questions per data set settle it:
Who decided this data would be collected, and why? If your customer, you are processing for them.
Who can repurpose it? If you cannot without the customer’s instruction, you are a processor.
Whose data principals are they? A relationship with your customer, not you, points to processor status.
Worked examples
A payroll SaaS storing salary and bank details for 400 client companies is a processor for that data: the client decided to collect it and could switch vendors tomorrow. The same company is the fiduciary for the HR managers who log in, because it chose to collect their names, emails and login logs for its own account management.
A CRM or analytics product that pools customer data to build benchmark models is harder. If it uses customer data for its own product improvement or model training, it is determining a purpose of its own, and in our reading becomes a fiduciary for that processing. The Act and Rules Explorer gives the exact statutory wording for these definitions.
What a data processor under DPDP Act must actually do
These obligations flow from Section 8 and the DPDP Rules, 2025 (notified November 2025) through your contract, plus the CERT-In Directions of April 2022 which apply to you directly.
| Obligation | Source | What it means for a SaaS processor |
|---|---|---|
| Act only under a valid contract | s.8 | No processing of customer personal data outside a signed agreement with data terms. “We will paper it later” does not qualify. |
| Process only on documented instructions | Contractual, flowing from s.8 | Use the data only to deliver the contracted service. Analytics, model training or benchmarking need explicit authorisation. |
| Reasonable security safeguards | s.8, Rules on safeguards | Encryption, access control, logging with one-year retention, backups, contractual measures. Customers expect evidence, not assurances. |
| Breach support | s.8, Rules on breach notification | The fiduciary must notify principals and the Board without delay and report in detail within 72 hours. Your notice to the customer must be fast enough to make that possible. |
| Erasure on termination | s.8 via contract | Delete or return data on exit, including backups within a stated window, and certify it. |
| CERT-In incident reporting | CERT-In Directions, April 2022 | Report listed incidents within 6 hours, keep logs 180 days within India, NTP sync. Applies to you directly. |
The statutory obligation sits with your customer; the contract turns it into yours. A weak DPA is how you accept an open-ended indemnity instead of a manageable set of duties. The stakes explain why customers are aggressive: under the Schedule, failure of security safeguards attracts up to Rs 250 crore and failure to notify a breach up to Rs 200 crore. Those penalties land on the fiduciary, who will look to recover from the processor whose control failed. Our penalties Schedule explainer walks through each tier.
What a SaaS data processing agreement India customers will expect should contain
There is no prescribed DPA form. In practice the market is converging on GDPR Article 28 style documents adjusted for Indian law. A SaaS data processing agreement India customers will accept should cover the following.
Scope and instructions
Define data categories, data principals, purposes and duration. State that you process only on documented instructions, with service documentation and admin console settings counting as instructions, and carve out processing required by Indian law.
Security safeguards
Attach a security annex mapped to the Rules’ safeguard list: encryption in transit and at rest, role-based access, MFA for privileged access, centralised logging with one-year retention, tested backups, vulnerability management. Cite ISO 27001 or SOC 2 Type II if held. Promise specific, verifiable controls, not “bank-grade security”.
Breach notification timeline
The clause customers negotiate hardest. Because the fiduciary must notify the Board without delay and report within 72 hours, most enterprise customers ask for processor notification within 24 hours of confirmation, some within 12. Commit to what your incident process can deliver and define “becoming aware” carefully. Our 72-hour breach response guide sets out a timeline that works from the processor side too.
Sub-processing
Obtain general written authorisation for the sub-processors in your register, with a notice period (30 days is typical) before adding one and a right to object. Commit to flowing down equivalent terms and remaining liable for sub-processor performance.
Cross-border transfers
Section 16 permits transfers outside India except to countries restricted by Central Government notification. Disclose hosting regions and offshore support access, and commit to complying with any restriction notification. See our Section 16 cross-border explainer.
Rights assistance, exit and liability
Commit to tooling for rights requests (the customer must meet its published response period, max 90 days under the Rules), audits on notice with a right to substitute a third-party report, and deletion within a defined period after termination, confirmed in writing. Resist unlimited liability; a super-cap of two to three times annual contract value is a common commercial landing point. The DPDP Starter Templates include a vendor agreement pack adaptable to the processor side.
DPDP for B2B software: the dual-role trap
DPDP for B2B software is harder than it looks because most SaaS companies think of themselves as “just a processor” and stop there. The dual-role trap is the set of flows where you are in fact the fiduciary and nobody has noticed.
Product usage data about your customer’s users. Login times, feature clicks and session recordings collected for your own analytics make you a fiduciary for that data, needing a Section 5 notice and a Section 6 or 7 basis.
Your own employees. Section 7 provides an employment legitimate use, but safeguards, breach handling and a grievance contact still apply.
Prospects and website visitors. Form fills, cookie tracking and lead enrichment are fiduciary activities from the first byte. Read our Section 7 lawful basis explainer before assuming a legitimate use covers B2B prospecting; in our reading it usually does not.
The fix is a data inventory that assigns a role to every data set. Flows tagged “fiduciary” go through your own compliance programme: notice, lawful basis, retention, rights handling. Flows tagged “processor” go through the contract programme above. A flow tagged both, such as product telemetry, is the one to escalate to counsel. DPDP 101 is a good grounding for product and marketing teams who need to understand why.
Sub-processor DPDP flow-down and the register you must keep
Every SaaS company uses sub-processors: hosting, email delivery, payment gateways, error tracking and, increasingly, AI model providers. A sub-processor DPDP flow-down binds each of them to terms at least as protective as your own DPA, because your customer’s Section 8 responsibility runs through you to them.
Three flow-down rules
First, no personal data reaches a vendor without data processing terms. A click-through ToS is a contract, but read it: many US vendors’ terms allow product improvement uses your customers have not authorised.
Second, map each sub-processor to the data it can touch; an error-tracking tool receiving full request payloads sees far more than its category suggests.
Third, maintain a register and a change notification process; customers cannot object to what they cannot see. Our vendor remediation explainer covers vendors who refuse to sign.
Sub-processor register template
| Sub-processor | Service provided | Data categories accessed | Data principal types | Hosting location | Contract and safeguards | Date added | Review date |
|---|---|---|---|---|---|---|---|
| Cloud IaaS provider | Compute, storage, backups | All customer data at rest | Customer’s users, end customers | Mumbai and Hyderabad regions | Enterprise agreement with DPA; ISO 27001, SOC 2 Type II | 01 Apr 2024 | 01 Apr 2027 |
| Transactional email service | Notification and OTP delivery | Name, email, phone | Customer’s users | Singapore | DPA signed; encryption in transit; 30-day log retention | 15 Jun 2024 | 15 Jun 2027 |
| Error monitoring tool | Application exception capture | Request payloads (scrubbed), user IDs, IP | Customer’s users | United States | Standard DPA; PII scrubbing enabled; 90-day retention | 10 Jan 2025 | 10 Jan 2027 |
| LLM API provider | AI features | Prompt text, may include personal data | Customer’s users | United States | Zero retention endpoint; no training on inputs; DPA signed | 05 Aug 2025 | 05 Feb 2027 |
Keep the register under version control; the review date column shows customers you actually manage it.
How to answer customer DPDP questionnaires and what to put on a trust page
Procurement teams in banking, insurance, pharma and IT services are already sending DPDP questionnaires to SaaS vendors. The questions are predictable, and vendors who answer fastest win deals.
The questions you will be asked
| Question | What a strong answer contains |
|---|---|
| Are you a fiduciary or processor for our data? | “Processor for data you load into the platform; fiduciary for your admin users’ account data, as described in our privacy notice.” |
| Where is our data stored? | Named regions including backup and DR, and offshore support access with controls. |
| What are your security safeguards? | Mapping to the Rules’ list, certifications, last penetration test, log retention. |
| How fast will you notify us of a breach? | A specific number of hours, the escalation path, and what the first notice will contain. |
| Who are your sub-processors? | Link to the register with change notification process. |
| What happens to our data at termination? | Deletion window, backup purge timeline, certificate of deletion. |
The trust page
A public trust page reduces questionnaire volume. It should contain your role statement, hosting and residency summary, a security overview mapped to the Rules’ safeguards, your sub-processor register, your standard DPA, your breach notification commitment, certifications with dates, and a named privacy contact for grievances. “Enterprise-grade security” persuades nobody; “logs retained 12 months in Mumbai region, MFA on all privileged access” does.
Run the Readiness Checklist against both your processor commitments and fiduciary obligations before publishing; a trust page that overstates controls becomes evidence against you in a dispute. Do not wait for May 2027: contracts signed in 2026 will still be in force when enforcement begins.
Frequently Asked Questions
Is a SaaS company legally liable under the DPDP Act if it is only a processor?
The Act places statutory obligations and penalties on the data fiduciary, which remains responsible regardless of any contract with the processor. In practice a processor’s liability arrives through the DPA, including indemnities and breach notification commitments. A processor also carries direct obligations under the CERT-In Directions, including six-hour incident reporting.
Do we need a DPDP-specific DPA if we already have a GDPR Article 28 DPA?
A GDPR DPA is a good base but needs adjustment. Indian customers will expect references to the DPDP Act and Rules, breach timelines that support the fiduciary’s 72-hour report to the Board, and Section 16 transfer language. Many firms maintain one global DPA with an India addendum.
Can we use customer data to train our AI models or improve our product?
Only if the contract clearly authorises it, and in our reading that use makes you a fiduciary for that processing, with its own notice and lawful basis requirements. Aggregation or anonymisation clauses help only if the output is genuinely no longer personal data.
How quickly must a processor notify its customer of a breach?
The Act and Rules do not set a processor-to-fiduciary timeline; they require the fiduciary to notify affected data principals and the Board without delay and file a detailed report within 72 hours. Enterprise contracts therefore typically require processor notification within 12 to 24 hours of confirmation.
Do sub-processors outside India create a problem under DPDP?
Section 16 permits cross-border transfers except to countries restricted by Central Government notification, so offshore sub-processors are generally permissible. Disclose locations in your register, commit to complying with any future restriction, and check sector rules such as RBI requirements for payment data that impose localisation independently.
Related explainers
Next step
If your customers are already sending DPDP questionnaires or redlining your DPA, a processor-side review will settle what you can commit to and where the dual-role gaps are. Our Privacy Governance Review covers your DPA, sub-processor register, security evidence and trust page in a single engagement. Book it before your next enterprise renewal cycle.