Article · 16 min read

What SaaS Providers Need to Know About India's Digital Personal Data Protection Act 2023

Irshad Rafeekhudheen PK · Wattlecorp Cybersecurity Labs Free Intermediate India

If you sell into Indian enterprises, DPDP is now part of the security review alongside SOC 2. This lays out the obligations that show up in a buyer's DPA: consent, breach notification to the Data Protection Board, deletion rights and cross border transfer limits.

  • Penalties run up to Rs 250 crore for failing to implement reasonable security safeguards.
  • A SaaS platform serving Indian users is a data fiduciary, accountable for what it collects, processes and stores.
  • Consent must be clear, informed and purpose specific, and children under 18 need verifiable parental consent.
  • Breaches must be reported to the Data Protection Board of India and to affected users, and cross border transfers are limited to government approved territories.
Open on wattlecorp.com ↗

The question it answers

  1. Security reviews keep stalling my deals. What do I actually need, and when should I get it?

Read with it

  1. Answers the actual question a founder has, which is when rather than whether, and draws the Type 1 versus Type 2 line clearly:... Workstreet Article · 12 min read When Should a Startup Get SOC 2? Timing Guide Travis Good
  2. The most honest list of what to actually build: SSO with forced 2FA, protected branches, centralised logging, infrastructure as... Latacora Article · 20 min read The SOC2 Starting Seven Latacora
  3. Video · 10 min SOC 2 Compliance: Everything Startup Founders Need to Know Rob Walling
eChai Partner Brands The partnership →