DPDP Compliance for SaaS Companies: What Enterprise Buyers Expect from Vendors
Learn how SaaS vendors can prepare for DPDP compliance with a practical checklist covering DPAs, subprocessors, security evidence, breach response and deletion
Large customers in India increasingly include data protection questions in vendor onboarding, and these questions can return at renewal. If you sell software or services to enterprises, expect a questionnaire or contract addendum that refers to the Digital Personal Data Protection Act, 2023 (DPDP Act). Enterprise buyers means large organisations that purchase or use SaaS products and assess the vendor’s data protection practices before onboarding or renewing a contract.
Buyers look for three answers. They want to know who is responsible for what, how customer data is protected, and what the plan is for an incident. Short, well organised documents cover all three. DPDP readiness for SaaS vendors means keeping them in order before reviewers ask.
Why Are Enterprise Buyers Asking About DPDP Readiness for SaaS Vendors?
The DPDP Act defines a Data Fiduciary as the business that decides why and how personal data is processed. Responsibility for the data stays with that business even when a vendor handles it. Suppose a bank runs customer messages through a SaaS tool. The bank remains answerable for how the tool treats those records, so it writes its expectations into the vendor contract.
A Data Processor, as the Act defines it, is a vendor that processes personal data on that business's behalf. A Data Fiduciary may appoint one only under a valid contract. Older contracts may say little about data protection, so an existing vendor may receive an addendum to sign.
The Government notified the DPDP Rules, 2025 on 13 November 2025 and is bringing them into force in stages. Consent Manager provisions apply from 13 November 2026. Most operating duties, including notice and consent, apply from 13 May 2027. Enterprise customers can use the months before that date to review vendors, so questions can arrive early. The Government established the Data Protection Board of India, the body that enforces the Act, on 13 November 2025.
Once those duties apply, a failure to take reasonable security safeguards can lead to a penalty of up to ₹250 crore under the Act. Buyers carry that exposure themselves, so their reviewers check the security of each vendor that can reach customer data.
Data Processor or Data Fiduciary: Which Role Does Your SaaS Company Play?
A SaaS company often holds both roles. Consider a CRM product that stores a bank's customer records. You handle those records on the bank's instructions, so you act as a Data Processor. Data about your own staff and sales leads is different. For that data the vendor is a Data Fiduciary, with the full set of duties. Most duties under the Act fall on the Data Fiduciary. DPDP compliance requirements for data processors therefore reach a vendor through the contract. Buyers may ask you to sign their own DPA or a contract addendum.
Reviewers also ask how you use customer data in practice. A product team may analyse usage data from a buyer's customers to improve features, or train models on it. In that case the team may be setting its own purposes for the data. The processor label in the contract may then differ from the facts.
You should prepare a one-page responsibility split for each product, with one row for each type of data. Each row states your role for that data and the purpose you use it for. Reviewers can read it in minutes, and it settles most role questions early.
What Should a DPDP-Aligned Data Processing Agreement Contain?
A data processing agreement (DPA) sets out what a vendor may do with a buyer's personal data. The Act requires such a contract. Under the Rules, it must also contain an appropriate provision for reasonable security safeguards, where applicable. Item 2 below is therefore a legal requirement. Buyers add the other items as contractual expectations, because each helps them meet their own duties.
Use of the data only on the buyer's written instructions and for the purposes the buyer states.
Security safeguards, with the controls described or attached.
Notice to the buyer of any breach within the time the contract names.
Buyer approval for subprocessors (other vendors the SaaS company relies on), with the same obligations passed on to each.
Help with requests from individuals about their own data, such as access, correction or erasure.
Return or deletion of the data when the contract ends, confirmed in writing.
Audit rights, or access to evidence such as reports and certificates.
Deletion clauses must allow for legal retention. The Rules require a Data Fiduciary to keep some data for a year, including data a vendor processes on its behalf. Rule 6 covers logs and related personal data. They are kept for one year to help detect and investigate unauthorised access, unless another law requires otherwise. Rule 8(3) covers personal data, associated traffic data and other processing logs. They are kept for at least one year for purposes listed in the Seventh Schedule to the Rules. Each rule applies only to the data and purposes it names. Other datasets follow the vendor's own retention schedule. A promise to delete everything within 30 days of termination can still conflict with these rules. Your DPA should say what you delete, what you keep because the law requires it, and for how long.
Related Reading:- Data Retention Policies under DPDPA: How Long Can You Hold Personal Data
How Buyers Run a DPDP Vendor Risk Assessment: Security, Subprocessors and Data Location
Security reviewers start with two checks: who can open the data and how it is encrypted. Monitoring and backup come next. Enterprise customers often ask for an ISO 27001 certificate or a SOC 2 report. Both show that an independent party has tested the vendor's controls. Neither the Act nor the Rules make them mandatory, so you should see them as evidence a buyer may request.
Subprocessors are other vendors that handle buyer data on the vendor's behalf, such as a cloud host or a support tool. Your register should list each subprocessor with its name, purpose, hosting location and contract status. Buyers want proof that the main contract's obligations reach these vendors too, and the register supplies it.
Reviewers also ask where the data is stored. You should state where you store and process data, including at any subprocessor outside India. The Act lets the government restrict transfers of certain categories of personal data to specified countries. Sector regulators such as the RBI set their own rules for the entities they regulate, including payment data. A bank may ask for local hosting under those rules. The DPDP Act itself contains no general requirement to host data in India.
Where Does Customer Data Travel Inside a SaaS Product?
Buyer data often travels further than one database. An enterprise product may pass it through the stages below. You can mark each stage, and the subprocessor behind it, on a data flow diagram. Reviewers then see the whole path in one document.
Primary application and database: the personal data fields stored for the buyer, and which vendor staff can see them.
Cloud hosting: which provider and region hold the data, and who controls access to it.
Product analytics and telemetry (usage data the product collects): whether usage events hold personal data, and what the vendor uses them for.
Customer support: which staff can open a buyer's account, who approves that access and where it is logged.
AI features: whether buyer data goes to an outside model provider and whether anyone trains a model on it.
Backups and logs: how long copies are kept, and how a deletion request reaches them.
Breach Response and Deletion: What Buyers Need to See
The breach notification rules (Rule 7) apply from 13 May 2027. From that date, a buyer that suffers a personal data breach must tell each affected individual and the Data Protection Board without delay. The buyer must then send the Board further details within 72 hours of becoming aware of the breach, or within a longer period the Board allows on a written request. A buyer can meet that timeline only if its vendor reports incidents early. Rule 7 places these duties on the Data Fiduciary. It sets no separate deadline for a vendor to inform the buyer, so the contract fixes it. Buyers often ask for a short window.
A breach runbook is the vendor's written, step by step plan for an incident. Reviewers gain confidence when it covers these points:
how incidents are detected and who decides that one is a breach
who contacts the buyer, and through which channel
what written report the buyer receives afterwards
You can also run a yearly tabletop exercise, where the team talks through a simulated incident and records the lessons. The exercise shows reviewers that the runbook works in practice. It is a recommended practice, since the Rules do not require it.
Once the main duties apply, a buyer must erase personal data when the person withdraws consent or the purpose has ended, unless another law requires the buyer to keep it. The buyer must also make sure its vendors erase it. The deletion process should show how deletion reaches live systems and backups, and how it is confirmed in writing.
DPDP Compliance Checklist for SaaS Companies: Which Items Are Ready?
To see where you stand, give each item below one of three statuses: Ready, In progress or Missing. Each item names the document that answers a buyer question and the team that owns it. The law prescribes the processor contract and the security provision. Everything else is contractual expectation or recommended practice.
Role mapping: the responsibility split, owned by legal and product.
Data inventory and flow: the data flow diagram and hosting statement, owned by engineering.
Agreement: the DPA template and addendum, owned by legal.
Subprocessors: the subprocessor register, owned by security and procurement.
Security evidence: certificates and a control summary, owned by security.
Incident escalation: the runbook summary and contact path, owned by security and customer success.
Retention and deletion: the schedule, owned by engineering and legal.
Consent and individual requests, where the product handles them: the procedure, owned by support and product.
You can keep the Ready items in one shared folder and turn each Missing item into a task with a named owner and a date. To test the folder, a colleague from the sales team can fill in a sample buyer questionnaire using only its contents. The gaps then become visible.
Should You Use DPDP Compliance Software or a Consultant?
A consultant and software cover different parts of the work. A DPDP compliance consultant reads the law against the vendor's actual products and works out which role applies to each type of data. The consultant also points out gaps and can draft the responsibility split and the DPA addendum. DPDP compliance software handles repeating work, such as keeping records and tracking requests. For DPDP compliance for SaaS companies, a consultant can help set the approach while software supports day to day workflows.
If your product handles consent or marketing data for buyers, a consent management platform in India can record each consent, the notice version shown and any withdrawal. In OneConsent, the consent audit trail lets a team search consent history and trace notice versions and withdrawals. A buyer can attach that record to its own file. Enterprise customers with many vendors may track reviews through their own third party risk management process. A consistent subprocessor register makes that easier.
Buyers may also ask about Consent Managers. A registered Consent Manager is a regulated intermediary that individuals can use to manage their consent across businesses. Registration provisions apply from 13 November 2026. Consent management software, which a business runs for its own use, is a different category.
Check Your DPDP Readiness Before Enterprise Buyers Ask
With the checklist complete, the remaining tasks for DPDP compliance for SaaS companies become clear. A OneConsent readiness review starts with your data flows, contracts and controls. You receive personalised findings and a prioritised plan. DPDP compliance services from OneConsent can then address the gaps that matter most to buyers. Explore OneConsent DPDP compliance solutions to see how consent records and audit evidence come together. You can also book a personalised demo to go through your own use case with the team.
Frequently Asked Questions
Have more questions?
Search our full DPDP knowledge base for more answers.