DPDP Rules status: compliance window active. Read the update

Skip to content
For SaaS

SaaS companies wear two hats under DPDP.

You're likely a Data Fiduciary for your own users AND a Data Processor for your customers' data. Both sets of obligations apply — to different data.

Educational only · not legal adviceLast updated: 4 Sep 2026Written and edited by Sandesh Kokate

Fiduciary, Processor, or both? Take the check →

What applies to you

Split your data map in two. Law, from 13 May 2027: for data you decide the purpose of, such as signups and billing, you are a Data Fiduciary. Notice, consent, rights, complaints and breach duties apply. Law: for data your customers put into your product, you act for them as a Processor under a contract (Section 8(2)).

What matters most for you

DPDP Rules, 2025 (Gazette PDF)DPDP Act, 2023 — Section 8 processor dutiesSection 16 — cross-border transfersG.S.R. 843(E) — phased commencement

Common situations

A customer asks for a DPA

Law: your customer may use you as a Processor only under a valid contract (Section 8(2)). Good practice: cover permitted use, security, sub-processing and deletion.

Your product uses AWS but the customer didn't consent to AWS

Good practice: list your sub-processors, such as cloud hosts, in your customer agreement. Cover them in your vendor contracts too.

Your AI feature processes customer data

Good practice: India's AI Governance Guidelines are advice, not law. Still, write down the purpose, how you tested it, and how people can step in.

Multi-tenant data architecture

Good practice: treat each customer's data as its own relationship. Make access controls and deletion work per customer.

Start here

Recommended first tool

DPDP Applicability & Action Check

Eight questions to confirm which hat you're wearing for which data — and get the checklist that follows from it.

Open

Deep dives

DPDP Rules, 2025

What the Rules actually require, rule by rule.

Read

Cross-border transfers

Where your customer data may legally sit.

Read

Fiduciary vs Processor

How the Act splits responsibility between you and your customer.

Read

India's AI governance stance

What applies to AI features inside a SaaS product.

Read
Quick self-check

Run the readiness checklist

Consent notices, rights requests, retention, breach response, and vendor contracts in one trackable list.

Run it now

Written by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →