DPDP for SaaS

Fiduciary or processor depends on the data, not the company

Draw the line per dataset: who decided this data should be collected, and for what? Your own account holders, leads and website visitors are yours. The end users and records inside a tenant are your customer’s.

As a processor you act on the customer’s instructions under a contract (s. 8(2)). Your DPDP duties come largely through that contract: security, telling the customer about an incident, and returning and deleting data at the end. The customer remains answerable to its own users and needs your help to answer them. Other laws can still apply to you directly, such as CERT-In’s directions on reporting cyber incidents. Under legal review: Which CERT-In directions apply to a SaaS provider and their reporting windows should be confirmed.

The line moves when you use tenant data for your own purposes: training a model on it, benchmarking across tenants, or mining it for sales leads. At that point you are deciding the purpose, and you need your own lawful basis.

Sending tenant data to an outside model provider adds a sub-processor. Whether that provider may keep the data, and whether it may train on it, is a question your customers will ask and your contract with the provider must answer.

You are the fiduciary for

Sign-ups, billing contacts, support requesters, marketing lists, your own website and product analytics.

You are a processor for

End-user records, files and messages your customers store in the product, processed on their instructions.

The line moves when

You use tenant data for your own purposes, such as model training, benchmarking or lead generation.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

A manufacturing company with 800 employees runs payroll and leave on an HR SaaS product. The product emails payslips through a delivery service, answers employees’ policy questions with an outside AI model, and runs on a cloud platform. The company’s HR manager signed up for the product and pays for it.

If the SaaS company pooled salaries across customers to sell a pay benchmarking report, it would be deciding its own purpose, become a fiduciary for that use and need its own lawful basis.

What a SaaS business holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Trial and sign-up forms
• Customer imports, integrations and APIs
• In-product events and session recordings
• Support tickets and shared screens
• Marketing forms and webinars
• AI features that send content to a model provider

Where it goes

Where SaaS businesses are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

43 controls written for SaaS businesses, on top of 66 common ones

Alongside the common controls, the SaaS assessment separates your own data from tenant data and then asks about the controls customers will check: data-processing terms, sub-processors and their changes, tenant isolation and support access, logs and telemetry, backups and deletion on exit, encryption and secrets, AI providers, integrations and API scopes, and where data is hosted.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. SAS-01 High

   For each kind of personal data in your systems, do you know whether you decide its use yourself or process it on a customer's behalf?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Every dataset is marked as yours or the customer's.

   Why it is asked: You are the Data Fiduciary for your own sign-ups and billing, and usually a Data Processor for what customers load. The duties differ.

2. SAS-04 Critical

   Is one customer's data kept separate from another's, and is staff access to customer data restricted and logged?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Tenants are isolated and staff access is restricted and logged.

   Why it is asked: A cross-tenant leak exposes one customer's data to another. Staff access is the next largest risk.

3. SAS-22 Critical

   Do support and engineering staff reach a customer's data only with that customer's permission, for a limited time, with each access logged?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Permission-based, time-limited and logged.

   Why it is asked: Standing access to every tenant is the most common route to a serious SaaS leak, and goes beyond the customer's instructions.

4. SAS-41 High

   Are AI providers that receive customer data bound by processor terms that bar them from keeping it or training on it, with their locations known?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Processor terms with no retention or training, locations known.

   Why it is asked: An AI provider receiving customer data is a sub-processor like any other; default consumer terms may let it keep or learn from the data.

5. SAS-07 Medium

   Do you keep personal data out of application logs and error tracking, or minimise it where it cannot be avoided?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Logs are scrubbed and retention is short.

   Why it is asked: Logs are copied widely and kept long. Personal data in them is often the least protected copy.

6. SAS-06 High

   When a customer leaves, can you return their data and then delete it, including from backups within a stated period?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Export, deletion and a backup expiry period are defined and used.

   Why it is asked: Your customer must have its data erased once its purpose ends (s. 8(7)(b)), and will require you to do it in your contract. Customers will ask for proof.

All 43 questions written for SaaS businesses

1. SAS-01 For each kind of personal data in your systems, do you know whether you decide its use yourself or process it on a customer's behalf? Organisation and role mapping
2. SAS-08 Have you identified every group of people whose data sits in your systems: your customers' admins and users, their end customers, your own leads and staff? Organisation and role mapping
3. SAS-09 Do your sign-up, onboarding and profile screens ask only for details you use? Data inventory and purpose
4. SAS-11 Is product telemetry limited to usage events, with customer content and personal fields kept out of analytics tools? Data inventory and purpose
5. SAS-10 Do you delete the data of expired trials, abandoned sign-ups and churned customers once the stated period ends? Data inventory and purpose
6. SAS-12 Do you publish a page or terms explaining, for customer content, that you act on the customer's instructions, which sub-processors are used and where data is hosted? Notice and transparency
7. SAS-13 Are product marketing emails sent only to users who agreed, separately from the service emails the product needs to send? Consent and lawful basis
8. SAS-14 Can customers find, export, correct and delete a specific person's data in the product, so they can answer requests from their own users? Data Principal rights
9. SAS-06 When a customer leaves, can you return their data and then delete it, including from backups within a stated period? Retention and deletion
10. SAS-45 When data is deleted, is it also removed from logs, caches, search indexes and analytics copies? Retention and deletion
11. SAS-15 Is there a stated retention period for backups, enforced automatically? Retention and deletion
12. SAS-16 Are decommissioned disks, servers and staff laptops wiped or destroyed, with a record kept? Retention and deletion
13. SAS-17 Is customer data encrypted at rest and in transit, including databases, file storage and backups, with keys managed and access to them restricted? Security safeguards
14. SAS-07 Do you keep personal data out of application logs and error tracking, or minimise it where it cannot be avoided? Security safeguards
15. SAS-18 Are production systems separated from development and staging, with no real customer data used outside production? Security safeguards
16. SAS-19 Are database passwords, API keys and encryption keys kept in a secrets manager, not in code or chat? Security safeguards
17. SAS-20 Are dependencies and infrastructure scanned for vulnerabilities and patched within set times by severity? Security safeguards
18. SAS-04 Is one customer's data kept separate from another's, and is staff access to customer data restricted and logged? Access control
19. SAS-22 Do support and engineering staff reach a customer's data only with that customer's permission, for a limited time, with each access logged? Access control
20. SAS-23 Is two-step sign-in or single sign-on enforced for staff on cloud consoles, admin tools, code repositories and email? Access control
21. SAS-24 When an employee or contractor leaves, is their access to every system, key and repository removed the same day? Access control
22. SAS-25 Can customer admins manage their own users' roles, enforce two-step sign-in or single sign-on, and see an audit log? Access control
23. SAS-26 Do you review every quarter who has production, database and admin access, and remove what is not needed? Incident testing
24. SAS-27 Is the product security-tested by someone independent (a penetration test or similar) at least yearly and after major changes? Incident testing
25. SAS-28 If an incident affects customer data, do your terms and your plan commit to telling each affected customer without delay, with the facts they need for their own reports? Breach response
26. SAS-29 Does your breach plan say who reports what: you to the Board and your users for your own data, and customers for theirs? Breach response
27. SAS-02 Do your customer contracts include data-processing terms covering purpose, security, breach notice and deletion at the end of the contract? Processors and vendors
28. SAS-33 Is customer content used only to provide the service, and never shared with or sold to others except sub-processors and where the law requires? Data sharing and disclosure
29. SAS-34 Do you keep a record of every disclosure of customer data outside your company, including to authorities? Data sharing and disclosure
30. SAS-35 Are requests from authorities for customer data checked by a named person, limited to what is required, and passed to the customer unless the law forbids it? Data sharing and disclosure
31. SAS-05 Do you know in which countries customer data and backups are hosted, and can you tell a customer on request? Transfer and storage location
32. SAS-36 Have you checked transfers abroad against any government restriction, and can you keep a customer's data in India where its sector rules require? Transfer and storage location
33. SAS-39 Do you keep, for each customer, the version of the data-processing terms they agreed and any specific instructions they gave? Records and evidence
34. SAS-40 Is there a written policy for engineers and support staff on handling customer data: access, exports, local copies, screenshots and sharing? Policy and training
35. SAS-03 Do you keep an up-to-date list of the sub-processors that can reach customer data, and tell customers when it changes? Processors and vendors
36. SAS-30 Do your agreements with sub-processors require security safeguards and immediate notice of incidents involving customer data? Processors and vendors
37. SAS-31 Before adding a sub-processor, do you assess its security, data locations and access controls? Processors and vendors
38. SAS-32 When a sub-processor is replaced, do you get confirmation that it has deleted customer data? Processors and vendors
39. SAS-41 Are AI providers that receive customer data bound by processor terms that bar them from keeping it or training on it, with their locations known? Processors and vendors
40. SAS-42 Are customers told which features send their data to AI providers, and can they turn those features off; and is their data used to train models only with their agreement? Consent and lawful basis
41. SAS-43 Are API keys and integration tokens scoped to what each integration needs, revocable by the customer, and logged? Access control
42. SAS-44 Do you document for customers what data each integration sends and receives, so they can describe it to their own users? Data sharing and disclosure
43. SAS-37 Where the product supports decisions about people, can customers check the data used, correct it and see how it affected the result, and is data passed to other systems kept consistent? Data quality

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• A data map marking each dataset as yours (fiduciary) or a tenant’s (processor)
• Standard data-processing terms and a sample signed copy
• Public sub-processor list, including AI providers, with the change-notification process
• Terms with each AI provider on retention and training, and the customer-facing setting to turn AI features off
• Support access procedure and a log extract showing time-limited, approved access
• Results of the last tenant-isolation or penetration test, and fixes made
• Logging policy showing what is scrubbed
• Offboarding procedure with backup expiry and a deletion confirmation template

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Map each dataset to fiduciary or processor, and write it down

   Now

2. Adopt data-processing terms and offer them to every customer

   Now

3. Put AI providers under processor terms that bar retention and training, and list them

   Now

4. Replace standing production access with time-limited, approved, logged access

   Before 13 May 2027

5. Scrub personal data from logs and analytics events

   Before 13 May 2027

6. Publish a sub-processor list and notify customers of changes

   Before 13 May 2027

7. Test deletion on exit, including backup expiry

   Ongoing, yearly

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a SaaS business usually needs

SaaS businesses mostly meet data protection through customers’ security and privacy questionnaires, and enterprise customers ask for evidence, not assurances.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.