Singahi has released a comprehensive compliance guide aimed at helping software, cloud, IT, and outsourcing companies navigate the data protection requirements set by India’s Digital Personal Data Protection (DPDP) Act, 2023. This guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” outlines 12 critical questions that data processors may face from Indian businesses during contract renewals and compliance evaluations, underscoring the growing importance of preparation as the Act’s provisions take effect on May 13, 2027.
The DPDP Act, notified by the Ministry of Electronics and Information Technology, introduces stringent rules for handling personal data. Key provisions, including those associated with security safeguards, breach reporting, and individual rights, are slated to become applicable in 2027. Data Fiduciaries, as stated in section 8(1) of the Act, will be accountable for the data processing activities of their Data Processors, irrespective of the existing contractual agreements.
Singahi’s guide extensively covers areas such as contractual obligations, information security, breach notifications, and data erasure, referencing both the Act’s sections and the DPDP Rules, 2025. It aligns these guidelines with ISO/IEC 27701, an international standard for privacy information management, and highlights potential financial penalties for non-compliance, which can reach up to ₹250 crore for inadequate security measures and ₹200 crore for failing to report data breaches.
Incident reporting is a focal point in the guide, noting that delays by service providers can hinder a client’s compliance with statutory deadlines. Under Rule 7, Data Fiduciaries must promptly inform affected individuals and the Data Protection Board of breaches, followed by a detailed report within 72 hours. Additionally, specific cyber incidents must be reported to CERT-In within six hours, as per directions from April 28, 2022. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, emphasizes the need for prioritizing breach notification clauses alongside provisions for sub-processors and data deletion in contracts.
The guide also delves into practical evidence requirements, such as data retention and audit readiness. It uses a scenario where a company using a cloud provider must keep relevant data and logs for a year before erasure, illustrating the requirements detailed in the DPDP Rules. While ISO 27701 certification is not mandatory for Data Processors, Significant Data Fiduciaries must appoint independent data auditors and conduct annual Data Protection Impact Assessments and audits.
Concluding with actionable steps, Singahi’s publication advises suppliers to prepare seven key documents, starting with the processing agreement. It also provides access to an ISO 27701 toolkit featuring 43 guides and free Control Packs with practical templates, supporting organizations in aligning with the forthcoming data protection landscape in India.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.