SaaS and IT Services: A DPDP Act Impact Study

Executive summary

Overall impact: Medium-High.

This study covers vertical SaaS built for Indian small and mid-sized businesses (SMEs), such as billing, payroll, clinic and school software; horizontal B2B SaaS sold mainly abroad; and IT services firms that build and run clients' systems. Global capability centres (GCCs) will be covered in a later study.

For most of their data these businesses are data processors under the Digital Personal Data Protection Act, 2023 (the DPDP Act): they act on behalf of a client, the data fiduciary that decides why and how data is used. The Act places almost all its duties on fiduciaries, so we rate the sector Medium-High rather than High: the impact is real, but most of it arrives through clients' contracts.

Three changes matter most.

• Clients will push their DPDP duties down the contract. From 13 May 2027 every Indian client must ensure "reasonable security safeguards", notify breaches to the Data Protection Board and affected people, erase data on time and answer for its processors. Each of these becomes a vendor requirement in procurement questionnaires and renewals.
• The incident clock gets tighter. CERT-In's six-hour reporting rule already applies. The DPDP Rules add a 72-hour detailed report to the Board, which the client can meet only if the vendor tells it quickly and fully.
• Where the firm acts for itself, it is fully exposed. Sign-ups, free trials, marketing lists, product analytics, AI training and the firm's own employees are all its own fiduciary processing. Consumer-facing SaaS at scale could even be designated a Significant Data Fiduciary.

CERT-In's directions and audit guidelines, MeitY's cloud empanelment, company and tax law on books of account, and RBI and SEBI outsourcing rules also reach the sector. For contract clauses, see Trayambic's checklist on vendor contracts for SaaS and GCCs.

Background

Vertical SaaS for Indian SMEs holds its customers' customer and employee data: employees' PAN, bank details and salaries in a payroll product, treatment notes in a clinic product, children's records in a school ERP. The customers often have no compliance staff and look to the vendor to make them compliant. Many products also run apps for their customers' end users.

Horizontal B2B SaaS sold globally processes data about its customers' users and contacts, mostly outside India, with Indian teams accessing production data for support and engineering. Contracts follow the customer's home-country law, so these firms already sign detailed data processing agreements.

IT services firms build, test, run and support systems for banks, insurers, government departments and foreign enterprises. Engineers access production databases, support teams handle clients' customers, and test environments are sometimes loaded with live data.

Across all three, the data principals (the people the data is about) are mostly the clients' customers and employees. The firm's own data principals are its employees, job applicants, trial users, website visitors and the business contacts in its sales pipeline. Typical sub-processors are cloud hosts, messaging providers, payment gateways, monitoring tools and AI model providers.

Legal framework

The DPDP Act and Rules

• Roles (section 2). The same company can be a fiduciary for some datasets and a processor for others.
• Fiduciary accountability (section 8). Section 8(1) makes the fiduciary responsible "irrespective of any agreement to the contrary", including for processing by its processors. Section 8(2) allows processors to be engaged only under a valid contract. Section 8(5) and Rule 6 require reasonable security safeguards, including encryption, obfuscation, masking or tokenisation, access control, logging and monitoring, backups, and suitable terms in processor contracts. Logs must be kept for at least a year. Section 8(6) and Rule 7 require breach notice to each affected person and to the Board without delay, with a detailed report within 72 hours. Section 8(7)(b) requires the fiduciary to make its processor erase data.
• Penalties. The Schedule allows penalties of up to ₹250 crore for failing to take security safeguards and up to ₹200 crore for failing to notify breaches. The safeguards item is written as an obligation of the data fiduciary. Section 33 speaks of breaches "by a person", but the Act's duties are framed almost entirely for fiduciaries, so a processor's exposure is mainly contractual.
• Non-residents (section 17(1)(d)). Processing in India of the personal data of people outside India, under a contract with a person outside India, is exempt from most of the Act. Sections 8(1) and 8(5) still apply.
• Transfers (section 16; Rule 15). Transfers abroad are permitted unless the government restricts a country by notification, and none has been notified. Section 16(2) preserves stricter sector rules.
• Significant Data Fiduciaries (section 10; Rule 13). The government may designate fiduciaries based on factors including the volume and sensitivity of the data and the risk to data principals. A Significant Data Fiduciary (SDF) must appoint an India-based data protection officer and an independent data auditor, carry out annual impact assessments and audits, check its algorithmic software, and keep in India any data a government committee specifies.

The main obligations commence on 13 May 2027. On the same date section 44(2) omits section 43A of the Information Technology Act, 2000, the compensation provision that has applied to body corporates handling sensitive personal data. Section 72A of that Act, which punishes disclosure of personal information in breach of a lawful contract, stays in force.

Other instruments

How they fit together

Under section 38, the DPDP Act applies in addition to other laws and prevails in a conflict. The instruments above rarely conflict with it; they add requirements on top. Section 16(2) matters most: the Act would allow hosting anywhere not restricted, but RBI, SEBI and MeitY terms keep regulated and government data in India, and company law keeps a daily back-up of books in India.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Processor by default, fiduciary by accident

The first task is to know, dataset by dataset, which role the firm plays. As a processor it follows instructions and the client carries the DPDP duties; as a fiduciary it carries them alone. Firms drift into fiduciary status in predictable ways.

• Product analytics on client data. Telemetry that measures feature usage across accounts is usually fine. Analytics that profile the client's end users for the firm's own purposes are not processing on instructions.
• Lead harvesting. Copying contacts found in customers' records into the firm's own sales pipeline makes the firm a fiduciary for those contacts.
• Model training. Using customer content to train a model that serves all customers is the firm's own purpose unless each client has instructed it.
• Direct relationships. When a payroll product offers employees a salary-advance feature, or a clinic product sends patients health tips, the firm has a relationship with the end user and is a fiduciary for it.

Each can be lawful, but only with contractual authority and, where the firm is a fiduciary, notice and consent.

Security and incidents: three clocks at once

The CERT-In Directions apply to "service providers, intermediaries, data centres, body corporate and Government organisations", so every firm with Indian systems must report listed incidents within six hours and keep 180 days of logs. CERT-In's audit guidelines of July 2025 expect at least one audit a year and require auditee data to stay on systems in India, but bind only entities "covered under the relevant provisions". Whether a private SaaS firm must commission an annual audit therefore depends on its regulator or contracts; firms selling to banks, insurers or government will be asked for one anyway.

The DPDP Rules add a third clock: the client must tell the Board and each affected person without delay and file a detailed report within 72 hours. It cannot do so without the vendor's facts on what happened, which data and how many people. A vendor that sends a forensic summary on day five has, in practice, caused its client's breach of the Rules. Rule 6 also requires logs to be kept for a year, longer than CERT-In's 180 days, and vendors holding logs must match it.

Data location: one product, several answers

Under the DPDP Act alone, a SaaS firm could host Indian data anywhere. In practice the answer depends on the customer.

• Government departments buy cloud services from offerings empanelled by MeitY. MeitY's empanelment terms require data centres and hardware in India, data residency limited to India and an STQC audit, and they cover SaaS as well as infrastructure.
• Banks and payment firms must apply the RBI's outsourcing directions and, for payment system data, the 2018 rule that such data is stored only in India.
• SEBI-regulated entities must use MeitY-empanelled cloud providers under SEBI's 2023 cloud framework, which also expects data to reside and be processed in India.
• The firm's own books must be backed up daily on servers in India under rule 3 of the Companies (Accounts) Rules, 2014, and GST records must be kept at the principal place of business for six years. Indian accounting and billing SaaS vendors are therefore part of their customers' statutory record-keeping, not just tools.

An India region is becoming a commercial requirement for vertical SaaS, though the DPDP Act does not demand one.

Global SaaS and IT services: what section 17(1)(d) does and does not do

For an IT services firm processing a US bank's customer data in Chennai under a contract with that bank, section 17(1)(d) removes most DPDP duties, though section 8(5) safeguards and CERT-In remain. The exemption does not cover Indian residents' data, the firm's own employees, or an Indian client's data, and it does not cover a contract signed with the client's Indian subsidiary rather than the foreign parent. Firms should record the contracting party and data origin for each engagement. Trayambic's vendor contracts checklist works through a GCC example; this study does not repeat it.

The India–UK CETA's digital trade chapter does not oblige India to permit data flows now, so it changes nothing here.

AI features

Most SaaS products now ship AI features. Sending client data to a model provider is sub-processing that the client must know about and the contract must permit. Using outputs to decide things about people, such as flagging attrition risk, engages the client's accuracy duty under section 8(3). And section 3(c)(ii) excludes only data the person made public (or that a law required to be published), not customer content or data others posted. MeitY's India AI Governance Guidelines of November 2025 are voluntary, so the DPDP Act and contracts remain the operative rules.

Worked example: a payroll SaaS company in Pune

A Pune company sells payroll software to about 1,500 Indian SMEs, a state public-sector undertaking, an NBFC and some US firms. It plans an AI assistant that answers employees' questions about their payslips. Its plan for May 2027:

1. 1.Role map. It is a processor for customers' employee data and a fiduciary for its own staff, trial users and contacts. A planned salary-advance feature would make it a fiduciary for employees who sign up, so it gets its own notice and consent.
2. 2.Incident terms. Its standard agreement now promises initial notice within hours and a structured report in time for the customer's 72-hour filing, and its own CERT-In report within six hours.
3. 3.Hosting. Indian customers' data and backups stay in an Indian region. The public-sector customer is served from a MeitY-empanelled offering. The NBFC's contract maps RBI outsourcing requirements, including storage in India.
4. 4.US customers. Their data is processed in India under contracts with US entities, so most of the DPDP Act falls away under section 17(1)(d). Security safeguards still apply, and the company keeps US and Indian datasets logically separate.
5. 5.AI assistant. It uses a model provider under a no-training, no-retention contract, discloses the provider as a sub-processor, and lets each customer switch the feature off.
6. 6.Deletion. On termination it exports data, deletes production copies within 30 days and backups on rotation, and reminds customers that statutory retention of their own records is their responsibility.

Compliance framework

Phased roadmap

• Now to December 2026: role map and inventory; hosting by customer segment; freeze new own-purpose uses of customer data.
• January to March 2027: new DPA and sub-processor list; joint incident rehearsal with a key client; rights-support features.
• April to May 2027: notices and consent for own processing; delete test copies and stale backups; brief sales teams.
• Ongoing: annual audit; track SDF notifications, section 16 restrictions and RBI or SEBI changes; review each AI feature before launch.

Recommendations

1. 1.Decide your role for every dataset and write it into the contract. Ambiguity will be resolved against you in a negotiation or an incident.
2. 2.Treat the client's 72-hour Board report as your deadline too. Commit to a notice window in hours and rehearse it.
3. 3.Run a single log policy that meets both CERT-In's 180 days in India and Rule 6's one year.
4. 4.Make India hosting a product option, not a custom deal. Government, RBI and SEBI customers will need it, and company law already requires it for books of account.
5. 5.Ship compliance features: rights search and export, configurable retention, audit logs and an admin view of sub-processors. SME customers will rely on them.
6. 6.Put AI features under the same discipline as any other sub-processor: disclosed, contracted, switchable and not trained on customer data without instruction.
7. 7.Keep section 17(1)(d) for genuinely foreign engagements, and document the contracting party and data origin each time.

Key takeaways

• Most SaaS and IT services data is processed for clients, so the DPDP Act arrives through contracts; where a firm uses data for its own purposes it becomes a fiduciary with full duties.
• Incident handling must meet CERT-In's six-hour rule and give clients enough to file the Board's 72-hour report.
• The DPDP Act allows hosting abroad, but MeitY empanelment, RBI and SEBI rules and the Companies (Accounts) Rules keep some data in India.
• Section 17(1)(d) relieves most duties for foreign clients' non-resident data, but security safeguards and CERT-In still apply.
• AI features add sub-processors and decision risks that must be disclosed, contracted and switchable.