Singahi has released a new compliance guide to assist companies in preparing for data protection requirements under India’s Digital Personal Data Protection (DPDP) Act, 2023. The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” is tailored for software, cloud, IT, and outsourcing firms dealing with Indian businesses. It addresses 12 key questions these suppliers might face during contract renewals and compliance checks. Given that most provisions of the Act will take effect on May 13, 2027, organizations handling personal data are encouraged to begin their preparations.
The Ministry of Electronics and Information Technology announced the DPDP Rules, 2025, on November 13, 2025, alongside the legislative timeline. While certain provisions, such as the establishment of the Data Protection Board, became effective immediately, others will be phased in over the coming years. Requirements for consent managers will start on November 13, 2026, with obligations related to security, breach reporting, data erasure, individual rights, and penalties becoming applicable by May 2027. The Act emphasizes that Data Fiduciaries are accountable for processing activities by their Data Processors, as stipulated in section 8(1).
Singahi’s guide delves into several crucial areas, including contractual obligations, information security, breach notifications, individual rights, data erasure, sub-processors, and audit requirements. It cross-references relevant sections of the DPDP Act and Rules with ISO/IEC 27701, an international standard for privacy information management. Highlighting potential financial penalties for non-compliance, the guide notes fines of up to ₹250 crore for inadequate security safeguards and up to ₹200 crore for failure to report data breaches. Rule 6(1)(f) necessitates contracts between Data Fiduciaries and Data Processors to include reasonable security measures.
Incident reporting is a focal point of the guide, stressing the importance of timely breach notifications. Rule 7 mandates that Data Fiduciaries must notify affected individuals and the Data Protection Board without delay, followed by a comprehensive report within 72 hours of identifying a breach. Additionally, specified cyber incidents must be reported to CERT-In within six hours as per directives from April 28, 2022. Rahul Verma, a Cybersecurity Sales Specialist at Singahi, advises suppliers to prioritize clauses related to breach notifications, sub-processors, and data deletion in their contracts.
The guide also covers practical evidence requirements, like data retention and audit readiness. For instance, the DPDP Rules illustrate that companies using cloud services to host customer data must retain relevant information and logs for a year before erasure. Though ISO 27701 certification is not mandatory for Data Processors, Significant Data Fiduciaries must appoint independent data auditors and conduct annual Data Protection Impact Assessments and audits. Singahi concludes its publication by recommending seven essential documents for suppliers, starting with the processing agreement, and provides access to its ISO 27701 toolkit, which includes 43 guides and Control Packs with practical templates.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.