Software and IT service providers working with Indian businesses now have a new resource to help them navigate the complexities of the Digital Personal Data Protection (DPDP) Act, 2023. Singahi has published a comprehensive guide titled “Processing personal data for Indian clients: the DPDP questions you will be asked.” This guide addresses critical questions data processors may face during contract renewals and compliance evaluations, preparing them for the Act’s upcoming requirements.
The DPDP Act, set to be largely enforceable by May 13, 2027, outlines essential protocols for data protection, with interim rules already in place. The Ministry of Electronics and Information Technology has set out a timeline that includes the immediate establishment of the Data Protection Board and the introduction of consent manager requirements by November 2026. The Act mandates that Data Fiduciaries maintain accountability for their Data Processors’ actions, as stipulated in section 8(1).
Singahi’s guide is designed to help companies align with these regulations, focusing on contractual obligations, information security, breach notification, and data erasure. It highlights potential financial penalties of up to ₹250 crore for inadequate security measures and ₹200 crore for failing to report data breaches. The guide also gives insights into ISO/IEC 27701, an international standard for privacy information management, offering a framework for aligning with the DPDP’s requirements.
Incident reporting is particularly emphasized, as service providers’ delays could hinder clients’ compliance with statutory deadlines. Under Rule 7, Data Fiduciaries must promptly inform affected parties and the Data Protection Board about breaches, with a detailed report due within 72 hours. Additionally, specified cyber incidents must be reported to CERT-In within six hours as per existing directives.
The guide also covers practical evidence requirements such as data retention and audit readiness. It suggests that while ISO 27701 certification is not obligatory, Significant Data Fiduciaries should conduct annual audits and Data Protection Impact Assessments. Singahi concludes the guide with recommended documents for suppliers, including a processing agreement, and offers a toolkit with guides and templates to support compliance efforts.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.