SaaS DPDP compliance
two roles, one company.

SaaS teams invest in the processor side, with encryption, audit logs, access control and a DPA, and overlook their own website, trial sign-up and marketing stack. There the company is a Data Fiduciary and owes notice, consent, withdrawal and erasure directly, the same duties its customers owe their users.

The pattern is familiar. The product ships behind SSO with a SOC 2 report. The marketing site runs a cookie banner installed once, a HubSpot or Marketo form with no consent record behind it, a chat widget that fingerprints visitors, and ad pixels from three campaigns ago. The enterprise buyer's security team reviews the product; the Data Protection Board, if a visitor complains, will look at the website.

The fix is to treat the marketing stack as a system with a data owner: an inventory of what it collects, a notice that names the purposes, tags held until consent, a consent record per lead, and a retention period for leads who never convert. The two-pass scan is a fast way to see how far the site is from that.

The DPDP Act puts almost no duties on a Data Processor directly. Section 8(1) makes the customer responsible for processing done on its behalf, and section 8(2) requires a valid contract. So a SaaS processor's obligations are whatever that contract says, and customers will write in what the Act demands of them.

Expect four things in a DPDP-aware contract. Security to the section 8(5) standard, because the customer's penalty exposure for a breach at your end is up to ₹250 crore. Breach notice fast enough for the customer to tell the Board and every affected person, with its detailed report due within 72 hours. Deletion on instruction and at contract end, because section 8(7) makes erasure the customer's duty and section 6(6) requires processors to stop when consent is withdrawn. Help with rights: access, correction and erasure requests the customer must answer within its published period. A DPDP data processing agreement template sets out clauses for each.

Selling to a bank, insurer or broker brings their regulator's rules into your contract. Each regulator keeps its entity accountable for data at vendors, so each entity pushes audit rights, incident clocks and residency terms onto you. The shortest clock usually wins.

The specifics differ. An insurer must contract for notification of a suspected cloud breach within four hours of discovery, and for a ban on using its data for advertising or any secondary purpose. A bank must report to RBI within six hours of detection, and will want your notice well inside that. A SEBI regulated entity is solely accountable for its data and logs at third parties, and CSCRF expects the hosting provider to have no kill switch that could lock the entity out of its own systems. All three will ask where data and backups sit. The vendor security questionnaire template shows the shape of what arrives in procurement.

The DPDP Act lets a SaaS company host Indian personal data abroad unless the government restricts the destination. Its regulated customers often cannot. Payment system data must stay in India, CERT-In wants ICT logs kept within Indian jurisdiction, and insurers must keep their logs in India too. Residency becomes a product requirement.

The practical questions arrive in procurement in a predictable order. Which region is the primary store in? Where are backups and disaster-recovery copies? Which sub-processors can reach the data, and from which countries: the support desk, the logging vendor, the LLM API behind a new AI feature? Can the customer choose the region, and can it be proven? A SaaS company that can answer from its architecture rather than from its terms of service shortens the review considerably. Section 16(2) of the DPDP Act matters here in the vendor's direction: a customer bound by a sectoral localisation rule will write it into the contract, and the Act will not be an answer to it. The cross-border transfer guide sets out the Act's own position.

For the security side, see SOC 2 and the ISO 27001 solution; for incident reporting, the CERT-In directions guide. For the law underneath all of it, read the DPDP Act and Rules 2025 guide. To see what your own website does before a visitor answers the banner, run the free two-pass cookie scan. The consent platform holds versioned notices in 22 languages, a hash-chained consent ledger, withdrawal relayed to each processor, and rights requests and breaches on their statutory clocks. The industries overview compares all eight sectors.