Singahi has unveiled a new compliance guide to support software, cloud, IT, and outsourcing companies in adhering to the data protection mandates of India’s Digital Personal Data Protection (DPDP) Act, 2023. The guide, entitled “Processing personal data for Indian clients: the DPDP questions you will be asked,” provides insights into 12 critical questions that data processors may face during contract renewals and compliance assessments with Indian businesses. As most provisions of the DPDP Act are set to take effect by 13 May 2027, organizations handling personal data are urged to prepare accordingly.
The Ministry of Electronics and Information Technology announced the DPDP Rules, 2025 on 13 November 2025, establishing a timeline for the law’s implementation. Immediate provisions include the creation of the Data Protection Board, while other requirements, such as those for consent managers, are slated for 13 November 2026. Key elements concerning security safeguards, breach reporting, data deletion, individual rights, and penalties will be enforceable from 13 May 2027. According to section 8(1) of the Act, Data Fiduciaries remain liable for the actions of their Data Processors regardless of the contractual terms.
Singahi’s guide delves into several pivotal areas including contractual responsibilities, information security, breach notifications, individual rights, data deletion, sub-processors, and audit requirements. It aligns its guidance with ISO/IEC 27701, the international standard for privacy information management, and underscores the severe financial penalties for non-compliance, which can reach up to ₹250 crore for lapses in security safeguards and ₹200 crore for failing to notify about data breaches. As stipulated by Rule 6(1)(f), contracts between Data Fiduciaries and Data Processors must ensure reasonable security measures are in place.
Incident reporting is a significant focus of the guide, as delays from service providers can impede a client’s ability to meet regulatory deadlines. Under Rule 7, Data Fiduciaries must promptly inform affected individuals and the Data Protection Board following a breach, with a detailed report required within 72 hours. Additionally, certain cyber incidents must be reported to CERT-In within six hours as per its directives from 28 April 2022. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, emphasized the importance of breach notification clauses, as well as provisions concerning sub-processors and data deletion when contracts conclude.
Furthermore, the publication addresses practical evidence requirements, such as data retention and audit readiness. An example from the DPDP Rules illustrates a scenario where a cloud provider hosting customer records must retain relevant data and logs for one year before erasure. While ISO 27701 certification isn’t mandatory for Data Processors, Significant Data Fiduciaries are required to appoint independent data auditors and conduct annual Data Protection Impact Assessments and audits. The guide concludes by recommending seven essential documents for suppliers, starting with the processing agreement, and offers access to an ISO 27701 toolkit with 43 guides and practical templates.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.