Singahi has released a compliance guide aimed at assisting software, cloud, IT, and outsourcing companies in preparing for the data protection requirements under India’s Digital Personal Data Protection (DPDP) Act, 2023. The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” is designed to address 12 common questions suppliers might face when handling personal information for Indian businesses, particularly during contract renewals and compliance assessments.
The DPDP Act’s provisions, notified by the Ministry of Electronics and Information Technology, are set to take effect from May 13, 2027. Key elements of the legislation include the establishment of the Data Protection Board and requirements concerning consent managers, security safeguards, breach reporting, data erasure, and individual rights. Under Section 8(1) of the Act, Data Fiduciaries remain accountable for the processing activities of their Data Processors.
Singahi’s guide offers an in-depth look at the responsibilities of contractual arrangements, information security, breach notifications, individual rights, data erasure, sub-processors, and audit requirements. It aligns guidance with ISO/IEC 27701, an international privacy information management standard, and highlights penalties for non-compliance, such as fines up to ₹250 crore for lapses in security safeguards and up to ₹200 crore for failing to notify data breaches. The guide underscores the importance of breach notification clauses, as delays can hinder a client’s ability to meet statutory deadlines.
According to Rahul Verma, a Cybersecurity Sales Specialist at Singahi, suppliers should focus on breach notification clauses, sub-processor provisions, and data deletion protocols. Rule 7 mandates Data Fiduciaries to report breaches to affected individuals and the Data Protection Board promptly, with a detailed report required within 72 hours. Additionally, certain cyber incidents must be reported to CERT-In within six hours, as per its directives from April 28, 2022.
Singahi’s publication also addresses practical evidence requirements, including data retention and audit readiness. For instance, under the DPDP Rules, a cloud provider hosting customer records must retain relevant data and logs for a year before erasure. Though ISO 27701 certification is not mandatory for Data Processors, Significant Data Fiduciaries must appoint independent auditors and conduct annual Data Protection Impact Assessments and audits.
The guide concludes with seven essential documents that suppliers should prepare, starting with the processing agreement. It provides access to Singahi’s ISO 27701 toolkit, which includes 43 plain-language guides and free Control Packs with practical templates, helping companies align with the new data protection framework.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.