How SaaS Companies Can Build DPDPA Compliance: Security, Privacy, Cookies & Vendor Management

Quick Recap

In Part I, we established that DPDPA applies to most SaaS companies, defined key roles, and outlined the shared responsibility model. Part II focuses on implementation—the practical steps to build a compliant programme.

Privacy Governance

Privacy Team

Establish a dedicated privacy function with clear roles and responsibilities :

• Privacy Officer/Lead: Overall accountability for the privacy programme
• DPO (if applicable): Mandatory for Significant Data Fiduciaries; recommended for all
• Legal Counsel: Advises on DPDPA interpretation and stays abreast of regulatory updates
• Security Lead: Implements security controls and manages incident response
• Data Protection Team: Handles Data Principal rights requests and consent management

Roles and Responsibilities

Privacy Committee

For larger organisations, establish a cross-functional privacy committee with:

• Monthly or quarterly meetings
• Compliance status review
• Incident and breach reporting
• Risk assessment oversight
• Strategic privacy decisions

Section 3: Privacy by Design

Privacy by Design means embedding privacy into your product development lifecycle from the start, not as an afterthought .

Product Development Phases

Requirement Gathering

• Identify what personal data will be collected
• Document purpose and legal basis (consent or legitimate use)
• Assess whether data minimisation is possible

Architecture

• Design for data minimisation and purpose limitation
• Implement encryption at rest and in transit
• Plan for data deletion and retention schedules
• Design for Data Principal rights workflows

Testing

• Privacy impact assessment (PIA) for new features
• Security testing (penetration testing, vulnerability scans)
• Privacy testing (data minimisation, consent flows)

Deployment

• Update privacy notices for new features
• Deploy with appropriate access controls
• Enable logging and monitoring

Monitoring

• Monitor for compliance drift
• Review consent records
• Update policies as features evolve

Section 4: Security Controls

DPDPA requires “reasonable security safeguards” to prevent personal data breaches . Here are the key controls:

Access Control

• RBAC: Role-based access control—grant least privilege access
• MFA: Multi-factor authentication for all administrative accounts
• Just-in-time access: Elevate privileges only when needed
• Access reviews: Periodic reviews of user access rights

Encryption

• In transit: TLS 1.2 or higher, preferably TLS 1.3
• At rest: AES-256 or equivalent for stored data
• Key management: Secure key rotation and separation of duties

API Security

• Authentication and authorisation for all API endpoints
• Rate limiting to prevent abuse
• Input validation and sanitisation
• API logging and monitoring

Logging and Monitoring

• Log all access to personal data
• Centralised logging with SIEM integration
• Real-time alerts for suspicious activity
• Log retention per regulatory requirements (CERT-In rules require 180 days minimum)

Secure Software Development (SSDLC)

• Security requirements in the development lifecycle
• Regular code reviews and security testing
• Vulnerability management and patching
• Supply chain security (SBOMs for components handling personal data)

Cloud Security

• Secure cloud configurations (no public S3 buckets)
• Data residency controls
• Cloud security posture management
• Shared responsibility understanding

Backup and Disaster Recovery

• Encrypted backups
• Immutable backup storage
• Regular restore testing
• Business continuity planning

Additional Controls

• SIEM: Security Information and Event Management for threat detection
• DLP: Data Loss Prevention to prevent data leakage
• Zero Trust: Verify every access request
• DevSecOps: Integrate security into CI/CD pipelines

Section 5: Cookie Management

Cookies collect personal data and require DPDPA-compliant consent .

Types of Cookies

Consent Banner

• Display prior to setting non-essential cookies
• Provide clear, specific information about each cookie type
• Enable users to give granular consent
• Record consent with proof (date, version, user ID)

Preference Centre

• Enable users to manage preferences
• Allow withdrawal of consent with ease equal to giving consent
• Maintain up-to-date records of preferences

Retention

• Retain consent records for 7 years (audit requirement)
• Delete cookies when consent is withdrawn

Section 6: Data Principal Rights

The DPDPA grants Data Principals rights to control their data .

Rights Overview

Right to Access

• Data Principals can request confirmation of whether you process their data
• They can request a copy of their data

Right to Correction

• Data Principals can request corrections to inaccurate data

Right to Deletion

• Data Principals can request erasure of their data

Right to Grievance

• Data Principals can lodge complaints about your data processing

Right to Nomination

• Data Principals can nominate someone to exercise rights on their behalf in case of incapacity or death

Rights Workflow

1. Request Intake: Web portal, email, or API for submitting requests
2. Identity Verification: Verify the requester’s identity before responding
3. Request Routing: Route to the appropriate internal team
4. Response: Fulfil within the 90-day timeframe
5. Tracking: Maintain audit trail of all requests and responses

Implementation Tips

• Automate rights requests with a Data Subject Request (DSR) portal
• Implement identity verification (OTP, app token, or similar)
• Set up workflows to execute erasure across connected databases

Section 7: Vendor Management

Vendors are one of the biggest compliance risks. Under DPDPA, you remain accountable for your vendors’ actions .

Types of Vendors

Vendor Management Process

Assess

• Conduct security assessments before onboarding
• Review vendor’s SOC 2, ISO 27001, or similar certifications
• Assess their subprocessor chain

Contract

• Include DPDPA-compliant clauses in the Data Processing Agreement (DPA)
• Define purpose limitation and documented instructions
• Include breach notification obligations and timelines
• Secure subprocessor approval rights
• Include return/deletion obligations at contract termination

Monitor

• Continuous vendor risk monitoring
• Regular reviews of vendor compliance
• Track vendor security incidents

Audit

• Audit rights in contracts (or standard industry audit reports)
• Periodic vendor security reviews

Section 8: Contracts

Contracts are foundational to DPDPA compliance, particularly for vendor relationships .

Key Agreements

MSA (Master Services Agreement)
The primary contract with your customers defining service terms.

DPA (Data Processing Agreement)
Critical for B2B SaaS. Should include:

• Purpose limitation and processing instructions
• Security safeguards
• Breach notification obligations
• Subprocessor approval rights
• Data return/deletion obligations
• Assistance obligations for Data Principal rights

Privacy Policy

• Must be accessible via a conspicuous link on website homepages
• Must include an itemised description of data types collected
• Must list all Data Fiduciaries and Processors sharing data
• Must explain the purpose of processing
• Must explain Data Principal rights and how to exercise them
• Must provide DPO contact details

Terms of Service

• General terms governing use of your platform
• Should incorporate DPDPA principles

Security Annexure

• Detailed security controls and commitments
• Evidence of security program

Subprocessor Agreement

• Agreement with your subprocessors
• Should mirror the obligations of your DPA

SLA

• Service level commitments
• May include security incident response commitments

Breach Notification Clauses

• Commit to notifying within specified timeframes
• Define what constitutes a notifiable breach

Section 9: Personal Data Breach

The breach lifecycle under DPDPA requires a structured response .

Breach Lifecycle

text

Detect → Contain → Investigate → Notify → Recover → Review

Detect

• Security monitoring (SIEM, intrusion detection)
• User reports
• Vendor notifications

Contain

• Isolate affected systems
• Block attack vectors
• Terminate unauthorised access

Investigate

• Determine scope: what data was affected?
• Identify root cause
• Assess impact on Data Principals

Notify

• Data Protection Board: Within 72 hours of becoming aware
• Affected individuals: Without undue delay
• CERT-In: Within 6 hours for certain categories of incidents
• Document all notifications

Recover

• Restore systems
• Remediate vulnerabilities
• Strengthen controls

Review

• Post-incident review
• Identify lessons learned
• Update processes and controls

Breach Notification Content

• Nature of the breach
• Categories of data affected
• Number of Data Principals affected
• Consequences of the breach
• Measures taken to remedy
• Recommendations for Data Principals

Section 10: Implementation Roadmap

A structured approach to DPDPA implementation :

Week 1: Assessment

• Perform a gap assessment
• Map data flows
• Identify all personal data processing activities
• Document current controls

Week 2: Gap Analysis

• Compare current state to DPDPA requirements
• Prioritise gaps by risk
• Create remediation plan

Week 3: Policies

• Draft Privacy Policy
• Create Consent Framework
• Develop Retention and Deletion Policy
• Create Data Breach Response Policy
• Draft Vendor Management Policy

Week 4: Contracts

• Review and update all vendor agreements
• Issue DPAs to vendors
• Update customer agreements

Week 5: Technical Controls

• Implement encryption
• Deploy access controls
• Set up logging and monitoring
• Implement cookie consent banner

Week 6: Training

• Conduct employee training
• Develop privacy awareness programme
• Train incident response team

Week 7: Testing

• Test breach response (tabletop exercise)
• Test Data Principal rights workflows
• Conduct security testing

Week 8: Go Live

• Launch updated Privacy Policy
• Deploy consent mechanisms
• Begin continuous compliance monitoring

Section 11: Best Practices

1. Start with data discovery: You cannot protect what you don’t know you have .
2. Automate where possible: Manual processes don’t scale and are error-prone .
3. Integrate compliance into development: Privacy by Design is more effective than retrofitting.
4. Document everything: Compliance is about proving, not just doing.
5. Monitor continuously: Compliance is a journey, not a one-time project .
6. Align with existing frameworks: Leverage ISO 27001, SOC 2, and GDPR foundations .
7. Involve cross-functional teams: Privacy isn’t just legal—it’s security, engineering, product, and HR.
8. Think global, act local: DPDPA aligns with global privacy norms but has India-specific requirements.

FAQs

Q: What is the deadline for DPDPA compliance?
A: Full compliance is mandated by May 13, 2027 .

Q: Can we use GDPR as a template for DPDPA?
A: While there are similarities, DPDPA has India-specific requirements—such as consent in 22 languages and the Consent Manager concept .

Q: What is a Registered Consent Manager?
A: A licensed legal entity that provides a single dashboard for Data Principals to manage consent across multiple organisations. Most companies will not need to register as one .

Q: Is data encryption mandatory under DPDPA?
A: Encryption of personal data in transit and at rest is considered a “reasonable security safeguard” and is expected .

Q: What is the penalty for a data breach under DPDPA?
A: Up to ₹250 crore for failure to implement security safeguards or notify breaches .