Singahi has released a new compliance guide aimed at assisting software, cloud, IT, and outsourcing companies in navigating the data protection requirements outlined in India’s Digital Personal Data Protection (DPDP) Act, 2023. This guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” prepares data processors for the upcoming implementation of the Act’s provisions, most of which take effect on 13 May 2027.
The DPDP Act, enforced by the Ministry of Electronics and Information Technology, specifies a timeline for various compliance measures, including the establishment of the Data Protection Board and consent management, which begins on 13 November 2026. From 13 May 2027, organizations must adhere to strict rules around security safeguards, breach reporting, and data erasure, amongst other obligations. A key aspect of the Act is section 8(1), which holds Data Fiduciaries accountable for their Data Processors’ actions, irrespective of contractual terms.
Singahi’s guide delves into critical areas like contractual responsibilities, information security, and breach notifications, providing detailed insights into the legal expectations under the DPDP Act. It aligns these requirements with ISO/IEC 27701, an international privacy information management standard, and highlights the severe financial penalties for non-compliance, which can reach up to ₹250 crore for security lapse and ₹200 crore for failing to report data breaches promptly.
Incident reporting is a focal point of the guide, stressing that delays by service providers can impede a client’s ability to meet statutory notifications. According to Rule 7, Data Fiduciaries must promptly inform affected individuals and the Data Protection Board about breaches, and follow up with a comprehensive report within 72 hours. Additionally, certain cyber incidents must be reported to CERT-In within six hours, as per directions from April 2022. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, advises suppliers to prioritize breach notification clauses in contracts, along with terms for sub-processors and data deletion once contracts are concluded.
The guide also covers practical aspects of compliance, such as data retention and audit readiness. It provides examples like a cloud provider’s obligation to retain data and logs for a year before deletion. While ISO 27701 certification is not mandated for Data Processors, Significant Data Fiduciaries must appoint independent auditors and conduct annual Data Protection Impact Assessments. The guide concludes with a list of seven essential documents suppliers should prepare, including the processing agreement, and links to Singahi’s ISO 27701 toolkit, which offers practical templates and guides.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.