On this page
- When your technology company is a Data Processor versus a Data Fiduciary
- How the cross-border outsourcing exemption works for GCCs and IT exporters
- What the Rules expect from cloud providers and SaaS processors on logging and erasure
- Our view: a six-step readiness plan for SaaS, cloud and GCC leaders
- Common questions
- In the news
- Sources
India's technology sector spans B2B software-as-a-service products, cloud infrastructure providers, IT services exporters and Global Capability Centres (GCCs) that run engineering, finance, support and analytics for overseas parent groups. Because these organisations sit on both sides of the data flow—sometimes acting on a corporate client's instructions and sometimes collecting personal data for their own operations—getting the role boundary right under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 is essential.
When your technology company is a Data Processor versus a Data Fiduciary
Under the Act, a Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data, while a Data Processor is any person who processes personal data on behalf of a Data Fiduciary. Most B2B SaaS platforms, cloud hosts and IT outsourcing firms wear both hats at the same time for different datasets.
| Dataset in your environment | Who decides the purpose? | Your role under the DPDP Act | Primary obligations |
|---|---|---|---|
| Customer end-user records hosted inside your B2B SaaS or cloud workspace | Your enterprise client | Data Processor | Process only under a valid contract; maintain security safeguards, access controls and one-year logs; erase or return data when the client instructs |
| Your own B2B sales leads, website visitors, billing contacts and admin logins | Your company | Data Fiduciary | Provide itemised consent notices, honour rights requests, run a 90-day grievance desk and report breaches to the Board and affected users |
| Your India-based employees, contractors, job applicants and payroll records | Your company | Data Fiduciary | Apply the employment legitimate use or consent as appropriate, secure HR systems, bind payroll vendors under contract and report any breach |
| Foreign customer or employee data processed in India by a GCC or BPO under a foreign contract | Foreign parent or overseas client | Exempt from core fiduciary and rights chapters if within the cross-border outsourcing carve-out, EXCEPT security safeguards remain mandatory | Maintain reasonable security safeguards and overall responsibility; keep India-resident data separated from foreign outsourced datasets |
How the cross-border outsourcing exemption works for GCCs and IT exporters
The Act includes a dedicated exemption for cross-border outsourcing. Where personal data of individuals who are not within the territory of India is processed in India pursuant to a contract entered into with any person outside India by any person based in India, the main chapters on Data Fiduciary obligations, Data Principal rights and cross-border transfer restrictions do not apply to that foreign dataset.
However, GCC heads and IT services leaders must watch two critical boundaries:
- Security safeguards still apply in full: Even when a dataset qualifies for the foreign outsourcing exemption, the Act keeps overall fiduciary responsibility and the duty to protect personal data with reasonable security safeguards fully applicable. A breach of foreign customer data inside an Indian delivery centre still engages the security safeguard regime.
- India-resident data is never covered by the outsourcing exemption: Every GCC, IT exporter and SaaS company in India hires local engineers, collects resumes from Indian candidates, pays Indian vendors and often serves Indian enterprise or retail customers. For all personal data of individuals in India, every Data Fiduciary duty applies in full.
What the Rules expect from cloud providers and SaaS processors on logging and erasure
The DPDP Rules, 2025 specifically illustrate how retention and logging work when a Data Fiduciary uses a cloud provider. In the Rules' own illustration, when a company engages a cloud service provider as its Data Processor to store and manage customer records, the Data Fiduciary must ensure that the cloud provider also retains the data and the associated processing and traffic logs for the mandatory one-year minimum period before erasing them.
For SaaS and cloud engineering teams, this translates into four concrete product requirements by 13 May 2027:
- Tenant-scoped deletion APIs: When an enterprise customer receives a consent withdrawal or erasure request, or reaches the end of a retention period, your platform must be able to purge that specific record across primary databases, search indexes and replicas without breaking tenant isolation.
- One-year immutable audit and access logs: Your platform must log who accessed, modified or exported personal data and retain those logs for at least one year to support unauthorised-access detection and forensic investigations.
- Sub-processor governance: Every downstream infrastructure host, email relay, observability vendor or support tool that touches tenant personal data must be bound by equivalent contractual security clauses.
- Fast breach escalation: Because your enterprise customer has at most 72 hours to file a detailed breach report with the Data Protection Board of India, your incident response runbook must alert affected enterprise customers immediately with root-cause and scope details.
Our view: a six-step readiness plan for SaaS, cloud and GCC leaders
In our view, technology companies and Global Capability Centres should execute six steps before 13 May 2027:
- Segregate foreign outsourced datasets from India-resident employee, recruitment and domestic customer records at the database and access-control layer.
- Publish a standard DPDP Data Processing Addendum for your Indian enterprise customers covering security safeguards, one-year log retention, erasure propagation and breach escalation.
- Build self-service tenant APIs and admin tools for record-level erasure, correction and consent-withdrawal propagation.
- Deploy attribute-based access control and privileged access management so support engineers cannot query production tenant data without a logged ticket.
- Put your own India HR, recruitment, website lead capture and billing workflows through a full Data Fiduciary compliance check.
- Connect your cloud infrastructure and application logs to a 24x7 monitored security operations workflow with a one-year retention policy.
Common questions
Is a B2B SaaS company a Data Processor or a Data Fiduciary?
It is usually both. It acts as a Data Processor for the customer records its enterprise clients upload into their workspaces, and as a Data Fiduciary for its own Indian employees, job applicants, website leads and billing contacts.
Are Global Capability Centres (GCCs) and IT exporters completely exempt from the DPDP Act?
No. The cross-border outsourcing exemption covers only personal data of individuals outside India processed in India under a contract with a person outside India—and even there, overall responsibility and reasonable security safeguards remain mandatory. All India-resident employee, candidate and customer data is fully covered.
What do the DPDP Rules require from a cloud provider on data and log retention?
The Rules illustrate that when a Data Fiduciary engages a cloud provider as a Data Processor, it must ensure the cloud provider also keeps the personal data, traffic data and processing logs for the mandatory minimum period of one year before erasure.
What must a SaaS Data Processing Addendum include for Indian enterprise clients?
It must bind the processor to maintain reasonable security safeguards including encryption, access control, one-year processing logs and backups, cease processing on consent withdrawal, erase data when instructed, and escalate breaches promptly.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 09: Control your vendors, in the toolkit
- How-to 09b: Sign the vendor contract, in the toolkit
- How-to 10: Data leaving India, in the toolkit
- How-to 04: Set the rules, in the toolkit
- The free duties list, every duty in plain words
In the news
Cert-In advisory on AI calls for tighter cybersecurity controls: Experts
DPDP Act & Rules takeaway: Reports CERT-In’s enterprise advisory on securing autonomous software tools, API tokens and internal enterprise data stores.
View statutory briefing illustration
Source & Courtesy Reference: Business Standard (original report)Digital Threat Report 2025-26
DPDP Act & Rules takeaway: CERT-In, CSIRT-Fin and SISA report examining cloud infrastructure exploitation, third-party processor risk and continuous security monitoring.
View statutory briefing illustration
Source & Courtesy Reference: CERT-In (MeitY) (original report)Multiple Software Supply Chain Attacks Targeting Open-Source Packages and Developer Tools
DPDP Act & Rules takeaway: CERT-In advisory on software supply-chain compromises across npm, PyPI and developer environments—directly relevant to SaaS, cloud and GCC engineering teams.
View statutory briefing illustration
Source & Courtesy Reference: CERT-In (MeitY) (original report)Digital Personal Data Protection Rules notified by government
DPDP Act & Rules takeaway: Reports the notification of the DPDP Rules, 2025 and the 18-month window for technology platforms and processors to implement safeguards.
View statutory briefing illustration
Source & Courtesy Reference: The Hindu (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 22 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 2(i)Data Fiduciary
- Section 2(k)Data Processor
- Section 3Scope and application
- Section 6(6)Processor cessation on withdrawal of consent
- Section 8(1)Responsibility for Data Processors, applicable even under the cross-border outsourcing exemption
- Section 8(2)Engagement of Data Processor only under a valid contract
- Section 8(5)Reasonable security safeguards, applicable even under the cross-border outsourcing exemption
- Section 8(6)Personal data breach intimation
- Section 8(7)Erasure by Data Fiduciary and its Data Processors
- Section 16Processing of personal data outside India
- Section 17(1)(d)Exemption for personal data of Data Principals outside India processed in India under a foreign contract, subject to the chapeau keeping overall responsibility and security safeguards in force
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 6Reasonable security safeguards: encryption, access control, one-year visibility logs, backups and processor contract clauses
- Rule 7Breach intimation without delay and 72-hour Board report
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs, with Illustration Case 2 (cloud service provider)
- Rule 15Transfer of personal data outside India
Notifications
- G.S.R. 843(E), clause (c)Substantive duties in force eighteen months from 13 November 2025 (13 May 2027)
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
