Singahi has released a comprehensive compliance guide to assist companies in preparing for the data protection requirements under India’s Digital Personal Data Protection (DPDP) Act, 2023. The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” is aimed at software, cloud, IT, and outsourcing firms that handle personal data for Indian businesses, highlighting the crucial aspects they need to address during contract renewals and compliance checks.
The DPDP Act, with most of its provisions set to take effect from May 13, 2027, outlines significant obligations for organizations that process personal data. The Ministry of Electronics and Information Technology has already notified the DPDP Rules, 2025, and established the Data Protection Board. Key requirements, such as those related to consent managers and security safeguards, are scheduled for implementation in phases leading up to 2027. A notable aspect of the Act is that Data Fiduciaries remain accountable for the data processing activities of their Data Processors.
Singahi’s guide delves into critical areas such as contractual responsibilities, information security, breach notifications, individual rights, data erasure, and audit requirements. It aligns these aspects with ISO/IEC 27701, an international standard for privacy information management. The guide emphasizes the financial repercussions of non-compliance, including penalties reaching up to ₹250 crore for inadequate security safeguards and up to ₹200 crore for failing to notify personal data breaches.
Incident reporting is a focal point in the guide, emphasizing that delays by service providers in breach notifications can hinder a client’s compliance with statutory deadlines. According to Rule 7, Data Fiduciaries must inform affected individuals and the Data Protection Board promptly, with a detailed report required within 72 hours of breach awareness. Additionally, specified cyber incidents must be reported to CERT-In within six hours per directives from April 28, 2022. Rahul Verma, Cybersecurity Sales Specialist at Singahi, advises suppliers to prioritize breach notification clauses in contracts, followed by provisions for sub-processors and data deletion upon contract termination.
The publication also covers practical evidence requirements like data retention and audit readiness. For example, companies using cloud providers must retain customer data and logs for a year before erasure. While ISO 27701 certification is not mandatory for Data Processors, Significant Data Fiduciaries must appoint independent data auditors and conduct annual Data Protection Impact Assessments and audits. The guide concludes with a list of seven essential documents for suppliers, starting with the processing agreement, and offers access to an ISO 27701 toolkit containing guides and templates.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.