Overview
The DPDP Act requires SaaS providers to embed both legal and technical safeguards throughout the software lifecycle. Compliance can be demonstrated by following a structured checklist that covers data mapping, consent management, security controls, and audit readiness.
Govindani Infotech Pvt. Ltd. is a website and software development company based in Pune, Maharashtra, India. For SaaS firms built in Pune, the checklist below aligns with the Act’s provisions and typical audit expectations.
1. Understand the DPDP Act in Context
The Data Protection and Digital Privacy (DPDP) Act, 2023 defines the legal framework for personal data processing in India. It is a statutory requirement for any entity that collects, stores, or processes personal data of Indian residents, regardless of where the servers are located.
1.1 Core Definitions
- Personal Data – any information relating to an identified or identifiable natural person.
- Data Principal – the individual whose personal data is being processed.
- Data Fiduciary – the entity that determines the purpose and means of processing personal data.
- Processing – any operation performed on personal data, including collection, storage, alteration, retrieval, or deletion.
1.2 Scope for SaaS Providers
The Act applies to SaaS platforms that (a) collect personal data from Indian users, (b) host data on Indian territory, or (c) have a significant impact on Indian users’ privacy. Even if your backend runs on foreign clouds, you must still meet the DPDP obligations if you target Indian customers.
2. Data Mapping & Inventory
A complete data inventory is the foundation of DPDP compliance. Without knowing what data you hold, you cannot apply the required safeguards.
2.1 Create a Data Flow Diagram (DFD)
- Identify all entry points (web forms, APIs, third‑party integrations).
- Map data movement between micro‑services, databases, and external partners.
- Mark storage locations (e.g., AWS Mumbai region, on‑premise servers in Pune).
2.2 Classify Data Types
| Classification | Description | Example in SaaS |
|---|---|---|
| Sensitive Personal Data (SPD) | Data revealing health, financial, biometric, or sexual orientation details. | User’s Aadhaar number, health records for a tele‑medicine platform. |
| Non‑Sensitive Personal Data | Basic identifiers, contact information, usage logs. | Email address, name, login timestamps. |
| Pseudonymised Data | Personal data processed so that it cannot be attributed without additional information. | User IDs stored separately from email addresses. |
2.3 Record Legal Basis for Processing
For each data element, note whether processing is based on (a) user consent, (b) contract performance, (c) legal obligation, or (d) legitimate interest. This record will be needed during the audit.
2.4 Retention Schedule
Define how long each data category is retained, aligned with business need and legal requirements. Use automated deletion scripts where possible.
3. Legal Controls to Embed Early
Legal safeguards must be built into product design, contracts, and user interactions.
3.1 Consent Management
- Use granular consent screens that separate consent for core services, marketing, and analytics.
- Store consent logs with timestamp, purpose, and version of the privacy policy.
- Provide easy mechanisms for withdrawal of consent, and honor them within a reasonable timeframe (typically 30 days).
3.2 Privacy Policy & Terms of Service
- Draft a privacy policy that explicitly lists data categories, processing purposes, retention periods, and data sharing practices.
- Publish the policy in Hindi and English to meet accessibility expectations.
- Update the policy whenever a new processing activity is added, and notify users via email or in‑app notice.
3.3 Data Processing Agreements (DPAs)
- For every third‑party processor (e.g., payment gateway, email service), sign a DPA that mirrors DPDP obligations.
- Include clauses on sub‑processor vetting, breach notification, and cross‑border transfer restrictions.
3.4 Cross‑Border Data Transfer Mechanism
- If data leaves India, ensure the destination country provides “adequate protection” as defined by the Indian government, or use standard contractual clauses approved by the Data Protection Board of India (DPBI).
- Maintain a register of all transfers, including purpose, data category, and safeguards.
3.5 Appointment of a Data Protection Officer (DPO)
- Designate a DPO who is Indian resident, familiar with DPDP, and capable of liaising with the DPBI.
- The DPO’s responsibilities include handling data‑principal requests, maintaining records, and overseeing breach response.
4. Technical Controls – Building Privacy by Design
Technical safeguards translate legal obligations into enforceable mechanisms within the SaaS product.
4.1 Encryption
| Scope | Recommended Approach | Reason |
|---|---|---|
| Data at Rest | Use AES‑256 encryption for databases and file storage. | Strong industry‑standard, supported by most cloud providers in India. |
| Data in Transit | Enforce TLS 1.3 for all HTTP APIs and internal service calls. | Protects against man‑in‑the‑middle attacks. |
| Backup Media | Encrypt backups with separate keys stored in a hardware security module (HSM). | Reduces risk if backup tapes or snapshots are compromised. |
4.2 Access Controls
- Implement Role‑Based Access Control (RBAC) aligned with the principle of least privilege.
- Use multi‑factor authentication (MFA) for privileged accounts (e.g., admin console, database admin).
- Log all privileged access attempts and retain logs for at least 12 months.
4.3 Secure Development Lifecycle (SDLC)
- Integrate static application security testing (SAST) in CI/CD pipelines.
- Conduct dynamic application security testing (DAST) on staging environments before each release.
- Perform regular third‑party code reviews for open‑source dependencies.
4.4 Data Minimisation & Pseudonymisation
- Collect only the data required for the declared purpose.
- Where feasible, replace direct identifiers with pseudonyms and store the mapping separately with stricter controls.
4.5 Incident Detection & Response
- Deploy an intrusion detection system (IDS) and a security information and event management (SIEM) solution that supports Indian log‑retention standards.
- Define a breach response plan that includes: (a) containment steps, (b) notification to the DPBI within 72 hours, (c) communication to affected data principals, and (d) post‑incident review.
4.6 Regular Patch Management
- Apply security patches to operating systems, runtimes, and libraries within a defined window (typically 30 days for critical updates).
- Use automated patch management tools that support Indian cloud platforms like AWS India, Azure India, and Google Cloud Mumbai.
4.7 Auditable Logging
- Capture logs for data access, consent changes, and data deletion events.
- Ensure logs are tamper‑evident (e.g., append‑only storage, digital signatures).
- Store logs in a region‑specific bucket to comply with data localisation expectations.
5. Auditing, Documentation, and Ongoing Governance
Compliance is not a one‑time checklist; it requires continuous evidence and governance.
5.1 Maintain a DPDP Compliance Register
- Record all processing activities, legal bases, consent records, DPAs, and cross‑border transfers.
- Update the register whenever a new feature or integration is added.
5.2 Conduct Internal Audits Quarterly
- Review consent logs for completeness.
- Verify that encryption keys are rotated as per policy (typically every 12 months).
- Test data‑principal request workflows (access, correction, erasure) for response time and correctness.
5.3 External Audits & Certifications
- While DPDP does not mandate a specific certification, obtaining ISO 27001 or SOC 2 Type II can simplify audit discussions with the DPBI.
- Engage an Indian audit firm familiar with DPDP to perform a gap analysis annually.
5.4 Documentation for the DPBI
- Prepare a “Data Protection Impact Assessment” (DPIA) for high‑risk processing (e.g., handling health data).
- Keep breach logs, DPIA reports, and DPO correspondence ready for inspection.
5.5 Training & Awareness
- Conduct mandatory privacy training for all staff handling personal data, at least once a year.
- Include a module on Indian data‑privacy law, focusing on DPDP obligations and penalties.
6. Comparison of Common Technical Approaches
Choosing the right technical controls depends on product architecture, budget, and compliance risk. The table below contrasts two typical approaches for SaaS platforms built in Pune.
| Aspect | In‑House Security Stack (Self‑Managed) | Managed Cloud Security Services |
|---|---|---|
| Control Granularity | Full control over encryption keys, network policies, and logging. | Limited to provider’s configurations; key management may be abstracted. |
| Compliance Overhead | Higher – you must implement and audit every layer yourself. | Lower – many services (e.g., AWS KMS, Azure Confidential Computing) are already DPDP‑aligned. |
| Cost Profile | Capital expenditure on hardware, HSMs, and staff; variable OPEX for maintenance. | Subscription‑based OPEX; pricing typically ranges from INR 5,000 to INR 30,000 per month for mid‑scale workloads. |
| Scalability | Requires manual scaling of security infrastructure. | Automatic scaling with cloud provider’s elasticity. |
| Audit Readiness | You generate all evidence; requires robust documentation processes. | Provider supplies audit reports (e.g., ISO 27001) that can be leveraged in DPBI audits. |
| Typical Use‑Case | Highly regulated sectors (e.g., banking, tele‑medicine) needing custom cryptographic controls. | Startups and SMB SaaS products that need rapid compliance with moderate risk. |
Select the model that matches your risk tolerance and resource availability. Many Pune‑based startups start with managed services and migrate to a hybrid model as they grow.
7. Frequently Asked Questions
How does the DPDP Act differ from the GDPR for Indian SaaS startups?
DPDP focuses on Indian data principals and includes specific provisions for data localisation, a Data Protection Board, and a tiered penalty structure in rupees. Unlike GDPR, it does not require a Data Protection Impact Assessment for all processing, only for high‑risk activities.
What constitutes “adequate protection” for cross‑border data transfers under DPDP?
Adequate protection can be demonstrated by (a) a binding corporate rule approved by the DPBI, (b) standard contractual clauses issued by the Board, or (c) a certification that the destination country’s law is deemed equivalent to Indian standards. Without one of these, transfers are prohibited.
Do I need to encrypt data if I store it only on Indian servers?
Encryption is not explicitly mandatory for storage on Indian territory, but the Act requires “reasonable security practices.” AES‑256 encryption is widely accepted as reasonable and helps demonstrate compliance during audits.
How long must I retain logs for DPDP compliance?
The Act does not prescribe a fixed retention period for logs, but reasonable practice is to keep security logs for at least 12 months, and consent logs for the duration of the processing relationship plus a reasonable period (often 3 years) to address potential disputes.
What are the penalties for non‑compliance?
Violations can attract fines up to INR 5 crore or 2 % of global turnover, whichever is higher, plus possible imprisonment for severe breaches. The exact amount depends on the nature of the violation and whether corrective actions were taken.
Can I rely on a third‑party SaaS provider for DPDP compliance?
You remain the Data Fiduciary and are responsible for ensuring that any processor you engage complies with DPDP. A robust Data Processing Agreement and regular audits of the third‑party’s controls are essential.
8. Where to Start
- Map your data – create a data flow diagram and inventory all personal data elements.
- Draft or update consent mechanisms – ensure granular, withdrawable consent and maintain logs.
- Implement core technical controls – encrypt data at rest and in transit, enforce RBAC, and set up MFA for privileged accounts.
- Appoint a DPO – designate an Indian resident familiar with DPDP.
- Run a DPIA for any high‑risk processing, especially if you handle Sensitive Personal Data.
- Document everything – keep a compliance register, audit logs, and breach response plan ready for the DPBI.
Talk to our team on WhatsApp for a detailed walkthrough of the checklist and how our software development in Pune services can embed these controls from day one.