DPDP · SaaS
DPDP compliance for SaaS companies
Most SaaS companies are a Data Fiduciary for their own users and a Data Processor for their customers' data. We map the controls you already hold to the DPDP Act and show what is left to build.
What the law asks of saas businesses
A SaaS business usually plays two roles under the Digital Personal Data Protection Act, 2023. For the people who sign up to your product, you are the Data Fiduciary: you decide why and how their data is used, so notice, consent, rights and grievance handling are your responsibility. For the personal data your customers load into the product, you are usually their Data Processor, and your customers will expect a contract that lets them meet their own duties under section 8(2).
The DPDP Rules, 2025 add specific operational duties. If personal data is breached, the Data Fiduciary must inform each affected person and the Data Protection Board without delay, with a fuller report to the Board within 72 hours (Rule 7). Reasonable security safeguards are required by section 8(5) and Rule 6, and failing to take them can attract a penalty of up to ₹250 crore.
Most of these obligations apply from 13 May 2027. Enterprise customers are already asking SaaS vendors about DPDP in security questionnaires and contract renewals, so the practical deadline is often earlier.
Where to start · Entry B
DPDP Gap Overlay
Many SaaS companies already hold ISO 27001 or have built a GDPR programme. The Gap Overlay maps those controls to each DPDP requirement, so you reuse what you have and build only what is missing. It includes our readiness questionnaire and a lawyer reviewed report with a prioritised roadmap.
₹25,000 – ₹1,00,000+
Lawyer reviewed. 3–5 business days after payment, complete information and any evidence requested are received.
Also relevant: Privacy Contract & Vendor Review (₹5,000 – ₹15,000+).
ISO 27001 covers much of the security safeguards duty but little of notice, consent and rights. A GDPR programme covers more, but the DPDP Act differs on consent, children's data, breach notice and grievance handling. Our mapping shows exactly where your existing work helps and where the DPDP Act asks for more.
Questions we are often asked
We are a B2B SaaS company. Does the DPDP Act apply to us?
In most cases, yes. You hold personal data about your own users and your customers' staff, and you process personal data on your customers' behalf. The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.
Does ISO 27001, SOC 2 or GDPR compliance mean we comply with the DPDP Act?
No. These frameworks overlap with parts of the Act, especially security safeguards, but the DPDP Act has its own rules on notice, consent, rights, children's data and breach notice to the Data Protection Board. Holding another certification does not by itself mean compliance with the DPDP Act.
Can we keep hosting personal data outside India?
Generally, yes. Section 16 allows transfers outside India except to countries the government restricts by notification. A sector rule that requires data to stay in India, such as the RBI rules for payment data, still applies.
What do our customers need from us as their Data Processor?
A contract under which you process personal data only on their instructions, protect it, help them handle breaches and rights requests, and delete it when the contract ends. We review or draft these terms under Privacy Contract and Vendor Review.
A lawyer checks for conflicts and sends you an engagement letter with the exact fee, usually within one business day.
Start Gap Overlay