Software, cloud, IT, and outsourcing companies working with Indian businesses are urged to prepare for data protection requirements under India’s Digital Personal Data Protection (DPDP) Act, 2023. Singahi has released a compliance guide aimed at these data processors to navigate the forthcoming legal landscape. The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” outlines 12 critical questions that may arise during contract renewals and compliance checks.
The DPDP Act introduces several key obligations with most provisions taking effect from May 13, 2027. The Ministry of Electronics and Information Technology has set the timeline for the Act’s implementation, with some rules, like the establishment of the Data Protection Board, already in effect. Requirements for consent managers will begin on November 13, 2026, and additional obligations concerning security, breach reporting, data erasure, and individual rights will follow in May 2027.
Singahi’s guide delves into various aspects including contractual responsibilities, information security, breach notifications, and data erasure, mapping these to ISO/IEC 27701 standards for privacy management. The guide warns of severe financial penalties for non-compliance, with fines reaching up to ₹250 crore for inadequate security measures and ₹200 crore for failing to report data breaches.
The guide underscores the importance of timely incident reporting. Under Rule 7, Data Fiduciaries must notify affected individuals and the Data Protection Board immediately, with a detailed report required within 72 hours of discovering a breach. Further, specified cyber incidents must be reported to CERT-In within six hours as per its April 2022 Directions. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, advises prioritizing breach notification clauses and addressing sub-processor provisions and data deletion at contract termination.
Practical evidence requirements such as data retention and audit readiness are also covered. For instance, cloud providers must retain data and logs for a year before erasure. Even though ISO 27701 certification isn’t mandatory for Data Processors, Significant Data Fiduciaries are required to appoint independent auditors and conduct annual Data Protection Impact Assessments and audits.
Concluding its guidance, Singahi lists documents that suppliers should prepare, starting with the processing agreement and linking readers to its ISO 27701 toolkit for further resources. This comprehensive approach aims to equip companies with the knowledge and tools necessary to navigate India’s evolving data protection landscape effectively.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.