DPDP for SaaS: Fiduciary vs Processor, and What Your Contracts Must Say

A SaaS business under the DPDP Act wears two hats at once. For your own users — signups, billing, support tickets — you are a Data Fiduciary with the full set of duties. For the data your clients put into your product, you are a Data Processor working on their instructions. Confusing the two hats is the most common SaaS compliance mistake.

Hat One: Fiduciary for Your Own Users

Everything the Act requires of any business applies to your user base: a plain-language notice (Section 5, Rule 3), valid consent for each purpose (Section 6) — product emails and marketing emails are different purposes — working access, correction and erasure requests (Sections 11–12) with published response times (Rule 14), reasonable security (Rule 6), the 72-hour breach process (Rule 7), and deletion when accounts close (Section 8(7)). Our interactive checklist walks the full sequence.

Hat Two: Processor for Your Clients' Data

When a client loads their customers' data into your product, the client is the Fiduciary and you are the Processor. Section 8(2) requires that relationship to run under a valid contract — which is why every Indian SaaS company now needs a solid Data Processing Agreement (DPA). Yours should cover:

• Instructions: you process the client's data only for delivering the service, nothing else — no mining it for your own analytics or models without explicit terms.
• Security: the safeguards you maintain (encryption, access control, logging — the Rule 6 set), because the client answers to the Board for your failures.
• Breach flow-down: you tell the client without delay when something happens on your side; their Rule 7 clock starts when they become aware.
• Request support: when the client's customer demands erasure, the client needs you to actually delete it — on a timeline that lets them meet their published one.
• Sub-processors and exit: who else touches the data, and what happens to it when the contract ends.

Expect your clients' CAs and auditors to ask for exactly these terms — processor contracts are check 19 on the standard audit.

The Sales Angle Most SaaS Companies Miss

Every Indian business buying software now has to ask: "is this vendor DPDP-safe?" A ready DPA, documented safeguards, and exportable evidence of how you handle data stop being compliance chores and become sales collateral. The vendors who can answer the security questionnaire in a day win the deal.

Start Here

Run the free 2-minute checker for your fiduciary-side exposure, then work the 14-step checklist — steps 3 and 9 (processors and contracts) are where the SaaS-specific work lives.