Who this page is for
B2B SaaS products, IT/ITeS exporters, GCCs, cloud/datacentre operators, and managed service providers acting as both a Data Fiduciary for their own users and a Data Processor for enterprise clients.
The personal data typically processed in this sector
These categories are typical for organisations in this sector. Your data record (Step 03) is where you map your exact data flows and systems.
Workspace admin accounts, billing contacts & product telemetry
- Where it comes from:
- SaaS sign-up flows, Stripe/Razorpay billing, and product analytics
- What the Act says:
- Your SaaS company is the Data Fiduciary for your own account sign-ups, marketing leads, and billing contacts under Section 5 and Section 6.
Customer-uploaded end-user data processed under client instructions
- Where it comes from:
- Multi-tenant production databases, object storage, and support queues
- What the Act says:
- You act as a Data Processor under Section 8(2); your enterprise customer is the Data Fiduciary and requires a DPDPA-aligned DPA and sub-processor schedule.
Application, API, authentication & infrastructure audit logs
- Where it comes from:
- SIEM, cloud logging, WAF, and IAM audit trails
- What the Act says:
- Rule 8(1)-(3) and the Seventh Schedule require encryption, access control, and minimum 1-year retention of processing and security logs.
Cross-border cloud hosting, AI APIs & sub-processors
- Where it comes from:
- AWS/GCP/Azure regions, LLM/AI APIs, observability, and support tools
- What the Act says:
- Track cross-border transfers under Section 16 and Rule 15 and maintain an accurate sub-processor inventory (Step 09 & Step 10).
Which documents to start with
- Step 01: Start here. Confirm the Act applies and see which duties you already cover.
- Step 03: Know your data. List every item above, where it sits and which vendor or processor holds it.
- Step 05: Ask properly. The itemised notice shown with or before a consent request under Section 5(1) and Rule 3.
- Step 04: Set the rules. The governance policy behind your notices, retention, and vendor controls.
- Step 06: Keep only as long as needed. Erasure when the purpose ends unless another law requires retention, plus 1-year minimum log retention under Rule 8(3) and Seventh Schedule.
- Step 07: Answer people on time. Rights requests and grievance replies within the period you publish, up to 90 days under Rule 14(3).
- Step 09: Control your vendors. Your cloud, SaaS, payment, communication, and analytics processors.
- Step 09b: Sign the vendor contract. The mandatory Data Processing Agreement under Section 8(2).
- Step 11: When something goes wrong. Personal data breach notification to the Data Protection Board (within 72 hours under Rule 7) and each affected Data Principal.
Statutory timeline, SLA, and penalty ceiling
The DPDP Act, 2023 (9 Chapters, 44 Sections, 1 Schedule) and DPDP Rules, 2025 (G.S.R. 846(E), notified 13 Nov 2025: 23 Rules, 7 Schedules) enforce core Data Fiduciary obligations from 13 May 2027. Grievance redressal must complete within 90 days (Rule 14(3)), processing logs must be retained for at least 1 year (Rule 8(3) + Seventh Schedule), and failure to maintain reasonable security safeguards carries a statutory ceiling of up to ₹250 crore.
The documents are a drafting aid. Get legal advice for your situation.