DPDP Act for SaaS and IT Services Companies: A Compliance Guide

ConsentifyAI Team8 October 20263 min read

TL;DR

SaaS and IT services firms are usually Data Processors for their customers' data and Data Fiduciaries for their own: leads, users, employees and product analytics. Under the DPDP Act, customers stay liable and will push obligations down through contracts, so DPDP readiness becomes a sales requirement. Using customer data to train AI features can turn you into a fiduciary. Indian firms processing foreign individuals' data for foreign clients may fall within the Section 17(1)(d) exemption, but security duties remain.

Who this is for: founders, CTOs, security and legal leaders at SaaS companies, IT services firms and BPOs.

For SaaS and IT services companies, the DPDP Act arrives mostly through customers. Your customers are Data Fiduciaries, responsible under Section 8(1) for everything you do with their data. They will ask how you meet their obligations, and the answer will decide deals.

Two roles at once

Your data	Typical role
Personal data customers upload or process in your product	Data Processor
Your leads, website visitors and marketing lists	Data Fiduciary
User accounts and product analytics for your own purposes	Data Fiduciary
Your employees and candidates	Data Fiduciary
Customer data used to improve or train your product	Data Fiduciary for that use

See Data Fiduciary vs Data Processor.

As a processor: what customers will require

Section 8(2) allows customers to use you only under a valid contract, and Rule 6 requires that contract to include security safeguards. Expect customers' data processing agreements to ask for:

processing only on their instructions
Rule 6 safeguards: encryption, access control, logging (at least one year), backups
breach notification within hours, with the information they need for Rule 7
support for access, correction and erasure requests through APIs or admin tools
withdrawal and deletion on instruction, with confirmation
disclosed sub-processors and hosting locations
deletion at contract end

Having a ready DPDP addendum, a sub-processor list, a security overview and a trust page shortens every sales cycle.

AI features and product improvement

Using customer data to train models, build benchmarks or improve features is processing for your purposes. It makes you a fiduciary for that use, which needs a lawful basis and transparency. Agree it explicitly with customers, offer an opt-out, and prefer aggregated or anonymised data.

Sub-processors and hosting

Customers will want to know where their data is stored and accessed, and who your sub-processors are. Section 16 permits transfers unless a country is restricted, but sector rules (RBI, IRDAI, SEBI) may require some customers' data to stay in India. Offer an India hosting option if you sell to regulated sectors. See cross-border data transfers.

The outsourcing exemption

Section 17(1)(d) exempts most of the Act's obligations for personal data of people outside India that is processed in India under a contract with a person outside India. That covers much of India's IT services and BPO work for foreign clients. But it is partial: the Section 8(5) security safeguards and the fiduciary's responsibility under Section 8(1) still apply, and your foreign clients' own laws, such as the GDPR, still bind you contractually.

As a fiduciary: your own data

Do not forget your own house: marketing consent for leads and newsletters, cookie consent on your website, product analytics, and employee and candidate data. See marketing consent, cookie consent and DPDP for HR.

SaaS DPDP checklist

Roles mapped: processor for customer data, fiduciary for your own
DPDP addendum ready for customers
Rule 6 safeguards documented, including one-year log retention
Breach notification to customers within a defined window
APIs or tools for customers' rights requests and erasure
Sub-processor list and hosting locations published
Clear position on using customer data for AI or product improvement
Outsourcing exemption scope documented for foreign-client work
Your own marketing, cookies and HR data compliant

How ConsentifyAI helps

ConsentifyAI helps SaaS teams on both sides: as a fiduciary, it handles consent, cookies and rights for your own users and leads; as a processor, its ROPA and vendor tools document your sub-processors, locations and contract commitments, so you can answer customer questionnaires quickly and consistently.

Sources & references

DPDP Act, 2023 — Section 2(i), 2(k)
DPDP Act, 2023 — Section 8(1), 8(2), 8(5), 8(6), 8(7)
DPDP Act, 2023 — Section 16, 17(1)(d)
DPDP Rules, 2025 — Rule 6, Rule 7

Frequently asked questions

Is a SaaS company a Data Fiduciary or a Data Processor?

Usually a processor for the personal data customers put into the product, and a fiduciary for its own data such as leads, user accounts, employees and product analytics.

Do SaaS processors have direct obligations under DPDP?

The Act places obligations mainly on fiduciaries. Processors carry them through contracts, and customers will require DPDP-ready terms.

Can we use customer data to train our AI features?

Only with a lawful basis. If you use customer data for your own purposes, such as training models, you become a fiduciary for that use. Agree it clearly with customers.

What is the outsourcing exemption?

Section 17(1)(d) exempts most obligations for personal data of people outside India processed in India under a contract with a person outside India. Security safeguards and the fiduciary's responsibility still apply.

What do enterprise customers ask SaaS vendors about DPDP?

Hosting locations, sub-processors, breach notification times, support for rights requests and erasure, security controls, and whether customer data is used for the vendor's own purposes.