DPDP for SaaS and payroll providers

Last checked 22 Oct 2026 · Draft. Awaiting counsel review.

A SaaS or payroll provider that handles personal data for a client business is that business's Data Processor: the client stays responsible for the processing (s.8(1)) and may use the provider only under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)). For its own users, customers and staff, the provider decides why and how their data is used and is a Data Fiduciary, with the same duties as any other business from 13 May 2027.

Which duties weigh most for a SaaS or payroll provider?

The client's duties that reach into the provider's systems:

• Security safeguards at the vendor. A business protects the personal data its vendors hold for it as well as its own: encryption, masking or tokenisation, access control, access logs that are reviewed, backups, and logs and data kept for one year to investigate problems (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
• Stopping after a withdrawal. After a person withdraws consent, the client must make its vendors stop processing within a reasonable time, unless a law requires it to continue (s.6(6)).
• Erasure. When consent is withdrawn or the purpose is over, the client must make its vendors erase what it gave them (s.8(7)).
• One-year copy. For every use of personal data, by the client or by a vendor for it, the data, its traffic data and the logs of that processing are kept for at least one year, for the purposes in the Seventh Schedule only, then erased unless another law needs them kept longer (Rule 8(3), Seventh Schedule).
• Access replies. A reply to an access request names every other business and vendor the data was shared with (s.11).

The provider's own duties as a Data Fiduciary for its users, customers and staff:

• A notice and valid consent wherever it asks for consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)).
• Requests to see, correct or erase data and to name a nominee (s.11, s.12(2), s.12(3), s.14); a published contact and request route (s.8(9), Rule 9, Rule 14(1)); a grievance period of at most 90 days (Rule 14(3)).
• Breach intimations to each affected person and the Board without delay, and the detailed report to the Board within 72 hours of becoming aware (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
• Its own vendors, such as cloud hosting, email and payment providers, under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).

When do the duties start?

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.

What does Fohrkast do for a SaaS or payroll provider?

• Each duty in the Act and the Rules that applies to the provider as a business, with its date, its basis and the clause it comes from, in a rulebook that is signed, versioned and published with its redline at fohrkast.com/law/in.dpdp.
• A record of each vendor that processes personal data for the provider (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
• A rights desk and a grievance desk for the provider's own users, customers and staff, with each reply drafted in English or Hindi for the provider to send.
• The incident desk records the awareness time, never pre-filled, and drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)).
• On the provider's own website, a banner holds each marked tracker until the matching consent.
• A scanner that runs in the provider's own environment with a read-only login and sends Fohrkast labels and counts only, never personal data values or database credentials. Tested on 19 and 20 Oct 2026 against real servers of 42 database products, among them PostgreSQL, MySQL, Microsoft SQL Server, Oracle Database, MongoDB, Amazon RDS, Amazon Aurora, Amazon DynamoDB and Google BigQuery, and against SFTP, Linux servers over SSH, Windows shares, NFS and Amazon S3.
• Every step is written to a hash-chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

What does Fohrkast not do?

• Give legal advice.
• File or send on a business's behalf. The provider decides and sends every notice and report.
• Hold more personal data than a duty needs.
• Claim a security certification. Fohrkast holds none yet.

Each client remains the Data Fiduciary for the data it gives the provider, and the provider for its own users, customers and staff (s.8(1)).

Which plan usually fits?

A provider with a privacy lead or a compliance team usually fits Business: up to 3 legal entities, 25 seats and 15 connected data sources. A large or multi-company provider fits Enterprise: up to 10 legal entities and 40 connected data sources. A provider within every Professional limit can start on Professional. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: fohrkast.com/pricing.

Questions and answers

Is a SaaS company a Data Fiduciary or a Data Processor under the DPDP Act?

Both, for different data. For personal data it handles on behalf of a client business, it is that client's Data Processor, used only under a valid contract (s.8(2)), and the client stays responsible for the processing (s.8(1)). For its own users, customers and staff, it decides why and how the data is used and is a Data Fiduciary.

Does the DPDP Act cover employee data held by a payroll provider?

Yes. The Act covers personal data in digital form (s.3), staff records included. For staff data a payroll provider handles for an employer, the employer is the Data Fiduciary and stays responsible (s.8(1)), and the provider works under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).

What do a client's DPDP duties ask of its SaaS vendor?

The Rules ask for reasonable security safeguards in the contract between a business and its vendor (s.8(2), Rule 6(1)(f)). After a withdrawal the client must make its vendors stop processing within a reasonable time (s.6(6)), and when consent is withdrawn or the purpose is over it must make them erase what it gave them (s.8(7)). The one-year copy of data, traffic data and logs covers processing by a vendor too (Rule 8(3)).

Who reports a personal data breach at a SaaS or payroll provider?

The Data Fiduciary whose data was breached tells each affected person and the Board without delay and sends the detailed report within 72 hours of becoming aware (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). For a client's data, that is the client, which stays responsible for its vendor's processing (s.8(1)); for the provider's own users, customers and staff, it is the provider.

Which Fohrkast plan fits a SaaS or payroll provider?

Business, ₹49,999 a month billed yearly with GST extra, for a firm with a privacy lead or a compliance team: up to 3 legal entities and 15 data sources. A large or multi-company provider fits Enterprise, from ₹1,99,999 a month billed yearly with GST extra, plus a one-time onboarding fee.

Sources

• Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
• G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
• G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
• Fohrkast rulebook in.dpdp version 1: published duties.

Related duties in the published rulebook: vendor contracts, security safeguards, valid and withdrawable consent, erasure when the purpose is over, the one-year copy, the 72-hour report.

Not legal advice. Legal statements on this page are awaiting counsel review.