DPDP Act for SaaS, IT & Technology Companies: Guide
SaaS products, cloud platforms, app developers and IT-services firms sit in a double position. They are Data Fiduciaries for their own customers, staff and website visitors, and often Data Processors for the personal data their customers upload. The Act applies to both roles in different ways.
Work out which hat you wear for each data set. For your own account, billing, marketing and employee data you are a Data Fiduciary with the full set of duties. For customer data you only process on instructions you are a Data Processor, and the Act puts legal responsibility on your customer, who will push requirements to you through contracts, questionnaires and audits. Overseas processing for foreign clients has a partial exemption. Most duties take effect on 13 May 2027.
Who this covers
B2B SaaS and platform companies are fiduciaries for their own users' data and usually processors for end-customer data inside the product.
B2C apps and consumer tech are fiduciaries for user data, usage analytics and any device or location data.
IT-services, outsourcing and BPO firms are usually processors for clients, and fiduciaries for their own staff.
Cloud, hosting and infrastructure providers are processors, and sub-processors to their customers' customers.
AI and analytics companies become fiduciaries when they decide their own purposes for the data, for example to train models.
Personal data you are likely to hold
Key provisions for SaaS & Technology
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Defines a Data Fiduciary (decides purpose and means) and a Data Processor (processes on its behalf).
Covers processing outside India when it relates to offering goods or services to people in India.
A fiduciary may use a processor only under a valid contract, and stays responsible for the processing.
Large or high-risk technology platforms could be notified as Significant Data Fiduciaries.
Transfers abroad are allowed unless the Central Government restricts a country, and stricter sector rules prevail.
Processing of non-residents' data under a contract with a foreign person has a partial exemption.
Penalties up to ₹250 crore for security failures and ₹200 crore for breach-notification failures.
01Fiduciary or processor: decide for each data set
The test in Section 2 is who determines the purpose and means of processing. A project-management SaaS decides how to run its own billing and marketing, so it is a fiduciary for that. It does not decide why a customer stores employee records in the product, so it is a processor for that.
- Write the split down in a short data map: what you hold, in which role, and why.
- Do not drift. Using customer data for your own product analytics, benchmarking or model training is your own purpose. That makes you a fiduciary for that use, and you need a legal basis and your customer's agreement.
- Expect to be asked. Customers will ask which role you take in security questionnaires. Answer consistently.
02Customer contracts and sub-processors
Section 8 allows a fiduciary to use a processor only under a valid contract. Your customers will therefore ask you to sign a data processing agreement. Be ready with one that covers:
- Processing only on documented instructions, for the stated purpose.
- Security at least at the level of Rule 6: encryption or masking, access control, logging, backups.
- A named list of sub-processors, a way to be told about changes, and flow-down of the same terms.
- Prompt breach notice, so they can meet Rule 7. Agree a short outer limit in hours, not days.
- Help with Data Principal requests and return or deletion of data at the end of the contract.
- Audit or evidence rights, usually through reports and certifications.
03Overseas clients, overseas hosting and the outsourcing exemption
Foreign SaaS selling to India. Section 3 applies the Act to processing outside India connected to offering goods or services to people in India.
Indian firms serving foreign clients. Section 17 exempts processing of personal data of people outside India, done under a contract with a person outside India. This outsourcing exemption is narrow. It relieves you of most Chapter II duties, the rights in Chapter III and the transfer rule, but the duty to keep data secure (Section 8(1) and 8(5)) remains, and it does not cover data of people in India. Read the exact text before relying on it.
Hosting abroad. Section 16 and Rule 15 allow transfers unless the Central Government restricts a country. Significant Data Fiduciaries may be told to keep some data in India (Rule 13). Watch for orders and for stricter sector rules your customers face.
04Security, logging and incident response
Security failures carry the highest penalty ceiling, up to ₹250 crore. In practice: encryption in transit and at rest, strong authentication and role-based access, audit logs, tested backups, vulnerability management and secure development.
Rule 8 requires processing logs and traffic data to be kept for at least one year. Build your logging pipeline with that in mind, and apply access controls to the logs themselves, since they contain personal data.
For incidents, define what counts as a personal data breach, who decides, how fast you tell each affected customer, and how you support their report to the Board. CERT-In reporting under the IT Act runs in parallel and applies to you directly.
05Product features, AI and Data Principal requests
- Consent and notice in the product. If you are the fiduciary, sign-up flows need an itemised notice and separate consent for optional uses such as marketing and third-party sharing. If you are the processor, give customers the tools to collect consent and respect withdrawal.
- Rights tooling. Build export, correction and deletion endpoints and admin views so customers can act on requests quickly.
- AI and analytics. Training or fine-tuning models on personal data is a purpose of its own. Check that your notice covers it and that customer data is not used for training without the customer's agreement.
- Consent Managers. Rule 4 creates registered Consent Managers. If your product handles consent flows, decide whether to integrate with them.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Say processor for data they upload and that you handle on their instructions, and fiduciary for your own account, billing and marketing data. Put it in the DPA.
That is your own purpose. Do not use customer data for it without a lawful basis and the customer's agreement. Use de-identified or consented data.
Notify affected customers promptly under your DPA, help them report to the Board and each person, and run CERT-In reporting alongside.
Section 17 may exempt most Chapter II duties for that processing. Keep baseline security and check the exact scope before relying on it.
Pass the request to your customer, the fiduciary, and support them. Do not delete without their instructions unless your contract says so.
Compliance checklist
Common mistakes to avoid
Calling yourself a "processor" across the board while using customer data for your own purposes.
Signing customer DPAs without checking your sub-processors are bound by the same terms.
Treating the outsourcing exemption as a blanket exemption.
Logging full personal data in application logs with weak access control.
Using customer content to train models and justifying it later.
Common questions
Is a SaaS vendor a Data Fiduciary or a Data Processor under the DPDP Act?
Both, depending on the data. It is a fiduciary for data it collects for its own purposes and a processor for data it handles on a customer's instructions. The legal duties sit mainly with the fiduciary, so customers pass them on to you by contract.
Does the Act apply to a foreign SaaS company?
Yes, if it processes personal data outside India in connection with offering goods or services to people in India.
Does an Indian outsourcing firm have to comply?
For its own staff and for any data of people in India, yes. For personal data of people outside India processed under a contract with a foreign party, Section 17 gives a partial exemption. Security and certain baseline duties still apply.
Do we have to store data in India?
Not by default. The Act allows transfers unless restricted. Significant Data Fiduciaries may be required to keep specified data in India, and some sector regulators require it for their regulated entities.
Who reports a breach, the SaaS vendor or the customer?
The Data Fiduciary, normally the customer, intimates affected people and reports to the Board. The processor must tell the customer promptly so they can meet the deadlines.
Can we use customer data to improve our product?
Only if it is a purpose you are entitled to pursue for that data, and your contract and notices allow it. If you decide the purpose, you are acting as a fiduciary for that use.