The DPDP Act for SaaS companies: what changes by May 2027

Last reviewed 19 October 2026 by the InspireGRC team.

13 Nov 2025DPDP Rules notified

13 May 2027main obligations apply (18 months later)

72 hoursfor the detailed breach report to the Board

Up to ₹250 crorepenalty for failing to protect personal data

You probably have two roles

The Act sets duties for the Data Fiduciary, the organisation that decides why and how personal data is processed. A Data Processor processes data on a fiduciary's behalf.

For the data your business customers put into your product, such as their employees' or their customers' details, you are usually their processor.
For your own users, staff, leads and marketing lists, you are the fiduciary.

So most SaaS companies need both: a programme for their own data, and a credible answer when customers ask how you protect theirs.

When it applies

The Act was passed in August 2023 and the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The rules setting up the Data Protection Board took effect straight away. Consent manager provisions follow after 12 months. The main obligations on fiduciaries apply 18 months after notification, which falls in May 2027.

Eighteen months sounds long. In practice, enterprise customers are already adding DPDP clauses to renewals, so the deadline that matters is often your next contract.

As a processor: what customers will ask of you

The Act puts the legal duties on the fiduciary, but it lets a fiduciary use a processor only under a valid contract, and the fiduciary stays responsible for the processor's safeguards. Expect your customers to pass their duties to you through a data processing agreement covering:

Security safeguards at least as strong as the Rules describe: encryption, masking or tokenisation; access control; logs and monitoring to detect unauthorised access; and backups so processing can continue.
Log retention of one year for logs and related personal data, for detecting and investigating misuse, unless another law needs longer.
Fast breach escalation, so the customer can tell affected people and the Board without delay, and file the detailed report within 72 hours.
Erasure on instruction, including when a person withdraws consent, and return or deletion of data at contract end.
A list of your own subprocessors, and cooperation with audits and questionnaires.

As a fiduciary: your own data

Give a clear notice and get consent, unless a "legitimate use" in section 7 applies.
Apply the same security safeguards and keep logs for one year.
Report breaches to affected people and the Board, as below.
Erase data once the purpose is served, unless the law requires you to keep it.
Publish the business contact of the person who answers privacy questions, and answer grievances within the time you publish, which can be no longer than 90 days.
Get verifiable parental consent before processing children's data.

A company the Government notifies as a Significant Data Fiduciary has extra duties, including a Data Protection Officer based in India, impact assessments and periodic audits.

When something goes wrong

Under the Rules, a fiduciary must inform each affected person without delay, in plain language. They must also send the Board an initial intimation without delay and a detailed report within 72 hours of becoming aware, unless the Board allows longer.

The same event may also be a cyber security incident that must reach CERT-In within 6 hours. The two duties run side by side; meeting one does not satisfy the other. See our CERT-In 6-hour guide.

Data outside India

Section 16 allows transfers outside India except to countries the Government restricts by notification. Sector regulators can set stricter rules, and RBI already requires payment system data to be stored in India. Check your customers' sectors before choosing where to host.

Penalties

The Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.

Checklist

Map the personal data you hold, and mark where you are processor and where you are fiduciary.
Write a data processing agreement you are happy to sign, before customers send you theirs.
Check your safeguards against the Rules: encryption, access control, monitoring, backups.
Set log retention to at least one year for systems that touch personal data.
Write one breach playbook that covers CERT-In (6 hours), your customers, and the Board (72 hours).
Publish your subprocessor list and a privacy contact on your website.
Build erasure into the product: on request, on consent withdrawal and at contract end.

Sources

This guide explains the rules in plain English. It is not legal advice; for decisions about your own obligations, speak to a qualified lawyer.