- Home
- Industries
- DPDP for SaaS startups
Industry
DPDP for SaaS startups
A B2B SaaS company plays two roles at once: processor for the data customers put into the product, and fiduciary for its own sign-ups, leads and staff.
Short answer
A SaaS company that processes data on a customer's instructions is a Data Processor, and the customer, as Data Fiduciary, must have a valid contract with it (s.8(2)). For its own users, leads and employees, the SaaS company is a Data Fiduciary with notice, consent, security, breach and rights duties from 13 May 2027. Customers will pass Rule 6 security terms and breach reporting down to you by contract, so prepare for both roles.
Where personal data sits in a SaaS company
- Customer workspaces: whatever customers upload, often their own customers' and employees' data.
- Accounts and billing: admin names, work emails, phone numbers, GSTIN and invoices.
- Product analytics: event streams tied to user IDs, session recordings and feature-flag targeting.
- Marketing site: forms, webinar sign-ups, ad pixels and CRM records.
- Support: tickets, screen shares, and logs with customer data pasted into them.
- Sub-processors: cloud hosting, email delivery, error monitoring, support desk and analytics tools.
- Your team: employee and contractor records, and exports sitting on laptops.
B2B does not mean no personal data. A work email address such as a.sharma@example.com identifies an individual, so it is personal data (s.2). The same goes for admin names in audit logs and phone numbers in billing records.
DPDP duties that bite hardest
Some of these duties are yours directly as a fiduciary. Others reach you through customer contracts, because your customers must meet them for data you process on their behalf.
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Processor contracts | s.8(2) | Customers must have a valid contract with you. Expect data processing addenda covering instructions, security, breach reporting and deletion. |
| Security terms | s.8(5), Rule 6 | Customers must put security terms in processor contracts, so expect questions on encryption or masking, access control, logs kept a year, and backups. |
| Breach support | s.8(6), Rule 7 | Your customer must tell the Board and affected people without delay and report within 72 hours. It needs you to tell it fast, with facts. |
| Erasure on instruction | s.8(7) | When a customer's purpose ends or consent is withdrawn, the fiduciary must make its processors erase. Have a tested deletion path per workspace. |
| Your own notice and consent | s.5, s.6, Rule 3 | For your sign-ups and marketing, give a Rule 3 notice and collect marketing consent separately. |
| Rights for your own users | Rule 14 | Publish how your users make requests and which identifier they need. |
| Contact | Rule 9 | Publish who answers questions about processing, and mention it in every response to a Data Principal. |
Roles: fiduciary or processor
Draw the line by data set, not by company. Data in customer workspaces is usually processed on the customer's behalf, so you are the processor. Your own account, billing, marketing and employee data is yours, so you are the fiduciary.
Product analytics sits in between. If you use your customers' users' behaviour to improve your own product or to market to them, you are deciding that purpose; treat it as your own processing, cover it in your notice and contracts, and check the position with counsel.
Your customers stay responsible for processing done on their behalf (s.8), so they will ask you to list sub-processors and pass their terms down. Keep that list current and give notice of changes. Our processor contracts guide covers the clauses.
A 90-day starting plan
- 01Days 1 to 30: write a lean record of processing
List processing activities by data set and mark your role in each: fiduciary or processor. List every sub-processor and what it receives.
- 02Days 31 to 60: paper and notices
Publish a processing addendum template and a sub-processor list. Write a Rule 3 notice for your own sign-ups, and add a cookie banner to your marketing site.
- 03Days 61 to 90: breach and deletion
Write a breach runbook that tells customers fast. Test workspace deletion end to end, including backups. Publish your Rule 9 contact.
How TruePrivacy helps
- Records of processing keeps processing activities synced from discovery and exportable for customer questionnaires.
- Vendors and processors holds your sub-processors with risk levels, assessments sent through a vendor portal link, and contract tracking.
- Cookie consent and consent management cover your marketing site and your own users' choices.
- Breach management records incidents and runs the Rule 7 clocks for data where you are the fiduciary.
- Pricing: priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Is a SaaS company a Data Fiduciary or a Data Processor?
Usually both. It is a processor for data it handles on customers' instructions, and a fiduciary for its own users, leads and employees.
What DPDP duties fall on us as a processor?
The Act puts most duties on the fiduciary, which stays responsible for processing done on its behalf (s.8). Your duties come mainly through the contract the fiduciary must have with you (s.8(2)), so read your addenda closely.
Do SaaS startups need a DPO?
A DPO is required for Significant Data Fiduciaries (s.10(2)(a)). Every fiduciary must publish the contact of a person who can answer questions about processing (Rule 9).
When do the duties start?
Core obligations begin on 13 May 2027, when Rules 3, 5 to 16, 22 and 23 come into force.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin