Overview
Chargebee Inc. provides a global subscription management platform that processes high-value financial and personal data for thousands of businesses. As a Data Fiduciary for its own users and a Data Processor for its customers, Chargebee’s adherence to India’s DPDP Act 2023 is critical for its growing footprint in the Indian SaaS ecosystem. The current policy, updated for global standards, requires significant localization to meet the prescriptive requirements of Indian law.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Notice & Consent ⚠️
Chargebee uses a standard “notice-and-consent” model. However, the DPDP Act is more prescriptive than the GDPR in its notice requirements.
What the policy says: “By using our services, you acknowledge you have read and understood this Privacy Policy.”
DPDP Requirement: Section 6 requires that every request for consent be accompanied or preceded by a notice containing: (1) the personal data sought, (2) the purpose of processing, (3) how to withdraw consent, and (4) how to complain to the Board.
Gap: Chargebee does not provide this notice in the 22 languages specified in the Eighth Schedule to the Constitution of India, which is a mandatory requirement upon request/enablement for Indian residents. Furthermore, the “bundled” acknowledgment does not meet the “unconditional” and “specific” standard for affirmative consent.
Section 8 & 9 — Obligations & Data Retention ⚠️
Chargebee excels in security safeguards but falters on the specific “Right to Erasure” triggers under DPDP.
Strength: Chargebee maintains rigorous security (Section 8 alignment) including encryption at rest and in transit, and multi-tenant isolation.
Gap: Under Section 9 of the DPDP Act, a Data Fiduciary must erase personal data as soon as the purpose is served or consent is withdrawn. Chargebee’s policy states data is kept “as long as necessary for the purposes for which it was collected.” This lacks the statutory finality required by DPDP, which demands erasure unless a specific legal obligation to retain exists.
Section 10 — Significant Data Fiduciary (SDF) 🔴
Given Chargebee’s volume of sensitive financial data processing in India, it may be notified as an SDF.
Gap: The policy makes no mention of appointing a Data Auditor or conducting Data Protection Impact Assessments (DPIA), which are mandatory for SDFs under Section 10. There is no resident Data Protection Officer (DPO) in India mentioned; only a global Privacy Team.
Section 11-14 — Rights of Data Principal ⚠️
Chargebee provides a “Privacy Rights” section that covers access, correction, and deletion.
Gap (Nomination): Section 14 of the DPDP Act gives Data Principals the right to nominate any other individual to exercise their rights in the event of death or incapacity. Chargebee’s global policy has no mechanism for this. Gap (Correction): While Chargebee allows data updates, the DPDP Act mandates a proactive duty on the Fiduciary to ensure data is “accurate and complete” if it is used to make a decision that affects the Data Principal.
Section 12 — Grievance Redressal 🔴
Critical Gap: Chargebee directs users to its global privacy email. Under the DPDP Act, the Data Fiduciary must provide an effective grievance redressal mechanism.
- The policy does not mention the Data Protection Board of India.
- It does not provide a timeline for grievance resolution (DPDP expectations are typically 7-30 days).
- It does not list a specific Grievance Officer’s contact details for the Indian jurisdiction.
Section 16 — Cross-Border Transfers ✅
Current Status: Chargebee processes data primarily in the US, EU, and Australia. DPDP Alignment: Section 16 allows cross-border transfer unless the Central Government restricts it (the “negative list” approach). Since no restricted list has been published, Chargebee’s current transfer mechanisms (SCCs/DPAs) are technically compliant, though they should explicitly mention Indian data residency options if they exist.
Risk Assessment
| Category | Risk Level | DPDP Section | Analysis |
|---|---|---|---|
| Notice Format | HIGH | Section 6 | Lack of itemized, multi-lingual notice is a direct violation. |
| Nomination | MEDIUM | Section 14 | Total absence of the right to nominate an heir/representative. |
| Grievance | HIGH | Section 12 | No path to the Data Protection Board of India; no local officer. |
| Data Retention | MEDIUM | Section 9 | ”As long as necessary” language is too vague for DPDP’s erasure mandate. |
| Security | LOW | Section 8 | World-class encryption and audit logs exceed DPDP “reasonable” standards. |
Recommendations for Chargebee
- Draft an India-Specific Addendum: Create a dedicated section for Indian residents citing the DPDP Act 2023.
- Implement Nomination Rights: Add a field in the user profile to allow the nomination of a representative.
- Update Grievance Path: Explicitly state that Indian users have the right to appeal to the Data Protection Board if the internal grievance process is unsatisfactory.
- Language Localization: Ensure the Privacy Notice is accessible in regional Indian languages as required by Section 6(3).