DPDP Compliance for SaaS Companies
Learn how Indian SaaS companies should handle customer, employee, support and processor data under DPDP.
Discuss this page with an LLM
Now replace the sandwich shop with your SaaS & IT company. Where does personal data enter? Where does it sit? Who else touches it?
SaaS & IT DPDP Self-Check
Start here to understand why DPDP is relevant to SaaS & IT. Before any other task, first understand how personal data moves through the business.
What is SaaS & IT?
In this context, SaaS and IT means cloud products, software platforms, IT services, support desks, product analytics, customer success, employee systems and vendor tools that collect or process customer, user, employee and client data.
Children's data
- Do you collect age, class, school, parent details or learning progress?
- Can you separate child, parent and guardian data?
- Do you know which users are under 18?
Consent
- Can you prove where consent came from?
- Is consent collected before data is used for the stated purpose?
- Can consent be withdrawn without breaking the entire account flow?
Tracking and profiling
- Do you track usage, performance, attention, behavior or drop-offs?
- Is any of this used for ads, recommendations or nudges?
- Are analytics tools collecting user identifiers?
Vendors and SDKs
- Which CRMs, email tools, payment tools, analytics tools and support tools receive personal data?
- Do contracts say they process data only on your instructions?
- Can you delete or export data from each vendor?
Retention
- What happens when the service ends?
- What happens when a user leaves?
- What data is kept for certificates, invoices, disputes or regulatory records?
First action
- Map one user journey from sign-up to completion.
- Mark where data is collected, stored, shared, used for communication and deleted.
If this self-check exposed more than three unclear answers, the next useful step is a DPDP data journey map.
Book a DPDP clarity callSaaS & IT Company Analyses
Freshworks
Freshworks' privacy policy, with a future effective date of July 2025, is primarily tailored for international laws like GDPR and CCPA. Despite having an Indian entity, the policy completely omits the DPDP Act 2023, broadly claims 'legitimate interests' for many processing activities, and lacks critical details on data retention and security measures (in the provided text), exposing its Indian operations to significant DPDP non-compliance risks.
CleverTap
CleverTap is clearly built for GDPR and CCPA compliance, but it currently ignores India's DPDP Act entirely. For a company with deep Indian roots, directing Indian users to the Bulgarian Data Protection Commission for complaints is a major regulatory oversight.
Infosys
Infosys's global privacy policy is extensive but lacks explicit alignment with India's DPDP Act 2023. Its broad use of 'legitimate interest' and vague data retention periods create significant DPDP compliance risks, alongside an incomplete framework for Data Principal rights and grievance escalation specific to India.
Druva
Druva is technically secure but legally outdated for India's new law. Its reliance on 'browse-wrap' consent and vague retention timelines creates major compliance risks under the DPDP Act.
BrowserStack
BrowserStack is well-prepared for GDPR, which gives them a head start, but their 'take-it-or-leave-it' consent model and lack of India-specific grievance paths leave them exposed under the DPDP Act.
Google India
Google India scores 63/100, reflecting world-class privacy infrastructure hampered by a global-first approach. Indian users' data across Search, Gmail, Maps, YouTube, and Android flows to US infrastructure under US jurisdiction — creating the fundamental tension that DPDP was designed to address.
Zoho
Zoho scores the second highest at 72/100, reflecting its genuinely privacy-first culture. The company famously rejected advertising-based models, uses no third-party trackers, and publishes transparent sub-processor lists. The gaps are primarily around adapting its GDPR-centric framework to DPDP-specific requirements.
Frequently asked questions
Does DPDP apply if our SaaS only serves international clients?
If you process personal data within India, the law applies. Even if your customers are abroad, any data processing activity happening on Indian servers or by Indian employees must follow DPDP standards.
Are we a Data Fiduciary or a Data Processor for our B2B clients?
In most SaaS models, your client is the Data Fiduciary because they decide why data is collected. Your company is the Data Processor, meaning you must follow the Fiduciary's instructions and maintain security.
How do we handle data deletion requests for data stored in cold backups?
You must have a process to ensure that if a backup is restored, the deleted user's data is not re-added to your live database. You should document that the data is put beyond use until the backup is overwritten.