Singahi has released a comprehensive compliance guide aimed at assisting software, cloud, IT, and outsourcing companies in aligning with India’s Digital Personal Data Protection (DPDP) Act, 2023. With most provisions of the Act set to take effect from May 13, 2027, the guide is designed to prepare data processors for the stringent requirements they will face when handling personal data for Indian businesses.
The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” addresses 12 critical questions that suppliers may encounter during contract renewals and compliance checks. It covers key areas such as contractual responsibilities, information security, breach notifications, individual rights, data erasure, sub-processors, and audit requirements. The guide maps these topics to the relevant sections of the DPDP Act and Rules, as well as to ISO/IEC 27701, an international standard for privacy information management.
Significant financial implications are highlighted within the guide, noting penalties of up to ₹250 crore for lapses in security safeguards and up to ₹200 crore for failing to notify data breaches. These penalties underscore the importance of compliance for organizations operating as Data Processors, who remain accountable under the DPDP Act for processing activities carried out on behalf of Data Fiduciaries.
Incident reporting is a particular focus, with Rule 7 mandating that Data Fiduciaries notify affected individuals and the Data Protection Board promptly, followed by a detailed report within 72 hours of a breach. Moreover, cyber incidents must be reported to the Indian Computer Emergency Response Team (CERT-In) within six hours, as per its directives from April 2022. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, emphasizes the prioritization of breach notification clauses and the importance of addressing sub-processors and data deletion in contracts.
The guide also explores practical evidence requirements, such as data retention and audit readiness. It illustrates scenarios like cloud providers hosting customer records, which necessitate retaining relevant data and logs for one year before erasure. Although ISO 27701 certification is not compulsory for Data Processors, Significant Data Fiduciaries must conduct annual Data Protection Impact Assessments and audits, appointing independent data auditors to do so.
Concluding with practical guidance, Singahi’s publication outlines seven essential documents suppliers should prepare, including processing agreements, and provides access to an ISO 27701 toolkit. This toolkit offers 43 plain-language guides and free Control Packs with practical templates, supporting organizations in navigating the complexities of compliance under the DPDP Act.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.