Singahi has released a compliance guide to aid companies in navigating the requirements of India’s Digital Personal Data Protection (DPDP) Act, 2023. This guide is particularly aimed at software, cloud, IT, and outsourcing firms that handle personal data for Indian businesses. With the majority of the Act’s provisions set to come into force by May 13, 2027, the guide addresses 12 crucial questions these companies may face during contract renewals and compliance checks.
The DPDP Act establishes a framework for data protection, with key provisions such as the establishment of the Data Protection Board already in effect. Upcoming obligations include consent management by November 2026, and security safeguards, breach reporting, and individual rights by May 2027. A notable aspect of the Act is that Data Fiduciaries are held accountable for the data processing activities of their Data Processors, regardless of contractual terms.
Singahi’s guide delves into various areas such as contractual obligations, information security, breach notifications, and audit requirements. It provides a comprehensive overview of the financial risks associated with non-compliance, highlighting penalties that could reach up to ₹250 crore for security lapses and up to ₹200 crore for not reporting data breaches. The guide emphasizes the importance of immediate breach notification to affected individuals and the Data Protection Board, in line with Rule 7 of the DPDP Rules.
The guide also focuses on the practical aspects of compliance, such as data retention and audit readiness. For instance, companies using cloud services must retain data and logs for a year before they can be erased. While ISO 27701 certification is not mandatory, Significant Data Fiduciaries are required to appoint independent auditors and conduct annual Data Protection Impact Assessments.
Rahul Verma, a Cybersecurity Sales Specialist at Singahi, advises suppliers to prioritize breach notification clauses within their contracts, followed by agreements on sub-processors and data deletion protocols. This focus on incident reporting is crucial as delays can impede a client’s ability to meet statutory deadlines.
The guide concludes with a checklist of seven essential documents suppliers should prepare, starting with the processing agreement, and links to an ISO 27701 toolkit offering 43 guides and free templates. As the DPDP Act’s full implementation approaches, Singahi’s guide serves as a vital resource for companies aiming to align with India’s stringent data protection standards.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.