In response to India’s upcoming Digital Personal Data Protection (DPDP) Act, 2023, Singahi has released a comprehensive compliance guide aimed at equipping software, cloud, IT, and outsourcing companies with the necessary tools to meet the Act’s requirements. The guide, titled “Processing personal data for Indian clients: the DPDP questions you will be asked,” is designed to address key concerns that data processors may face during contract renewals and compliance evaluations with Indian businesses.
The DPDP Act, scheduled to come into full effect by May 13, 2027, introduces new data protection regulations that necessitate careful preparation by organizations handling personal data. The Ministry of Electronics and Information Technology has outlined a timeline for the implementation of these provisions, including the immediate establishment of the Data Protection Board and upcoming obligations around consent management and security safeguards.
Singahi’s guide delves into the contractual obligations, information security, breach notifications, individual rights, data erasure, sub-processors, and audit requirements linked to the Act. It aligns these requirements with ISO/IEC 27701, an international standard for privacy information management, and underscores the financial risks of non-compliance, which can result in penalties as high as ₹250 crore for inadequate security measures and up to ₹200 crore for failing to report data breaches.
Particularly, the guide highlights the importance of timely incident reporting. Under Rule 7, data fiduciaries are required to promptly inform both affected individuals and the Data Protection Board of breaches, followed by a comprehensive report within 72 hours. Additionally, specified cyber incidents must be reported to CERT-In within six hours. According to Rahul Verma, a Cybersecurity Sales Specialist at Singahi, emphasis should be placed on breach notification clauses, alongside provisions for sub-processors and data deletion upon contract termination.
The guide also addresses practical aspects of compliance, such as data retention and audit readiness. For example, it references the DPDP Rules’ illustration of a cloud provider needing to retain customer records for a year before erasure. Although ISO 27701 certification isn’t mandatory for Data Processors, significant data fiduciaries must conduct annual data protection impact assessments and audits.
Concluding with actionable advice, Singahi provides a list of seven essential documents that suppliers should prepare, beginning with the processing agreement. The guide also connects readers to its ISO 27701 toolkit, which offers 43 plain-language guides and practical templates to aid in compliance efforts.
About Singahi
Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.
Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
[email protected]
Legal Disclaimer:
The information contained in this article has been provided by independent third-party contributors, clients, or content partners. We do not independently verify the accuracy, completeness, legality, ownership, licensing, or reliability of submitted content, including text, images, videos, trademarks, or other media materials. The submitting party is solely responsible for ensuring that all content, including images and media assets, complies with applicable copyright, trademark, licensing, and intellectual property laws. We disclaim liability for any unauthorized use of copyrighted or proprietary materials by third parties. If you believe that any content published on this platform infringes your intellectual property rights, kindly contact the author above for prompt review and resolution.