New Singahi Guide: The DPDP Questions Clients Will Ask Their Data Processors

Singahi guide: the 12 DPDP questions Indian clients ask their data processors

It sets out 12 questions Indian companies will put to software, cloud and IT suppliers that process personal data for them, and the evidence that answers each.

LUCKNOW, INDIA, November 12, 2026 /EINPresswire.com/ -- Software, cloud, IT and outsourcing companies that handle personal data for Indian businesses should expect data protection questions in their next contract. From 13 May 2027, most of India's Digital Personal Data Protection Act, 2023 applies, and section 8(1) makes a company responsible for any processing its suppliers carry out on its behalf, irrespective of any agreement to the contrary.

The Ministry of Electronics and Information Technology notified the DPDP Rules, 2025 on 13 November 2025, along with the dates on which the Act takes effect. The provisions that set up the Data Protection Board applied from that day, and the consent manager provisions apply from 13 November 2026. The duties on security safeguards, breach reporting, erasure and individuals' rights, and the penalties, follow on 13 May 2027. The client is the Data Fiduciary and the supplier its Data Processor, which the client may use only under a contract that provides for reasonable security safeguards (section 8(2) and Rule 6(1)(f)).

The penalties fall on the client, and the two largest reach what happens at its suppliers. A Data Fiduciary that fails to take reasonable security safeguards, including over processing by its Data Processor, can be fined up to ₹250 crore, and up to ₹200 crore for failing to notify a personal data breach.

Indian companies have already seen how a breach at a processor plays out. In one case reported in 2021, an Indian airline said the data processor that ran its passenger service system had suffered a cyber attack affecting around 4.5 million people worldwide. The airline received the first notice from the processor in late February, but learned who was affected only in late March and early April.

Rule 7 of the DPDP Rules requires a Data Fiduciary to tell each affected person and the Data Protection Board about a personal data breach without delay, and to give the Board a detailed report within 72 hours of becoming aware of it. How well a client meets that depends on how quickly, and how fully, its processor tells it. Most Indian companies also owe CERT-In a separate report of specified cyber incidents within six hours of noticing them, under its Directions of 28 April 2022.

"I think most suppliers will first see DPDP as an extra schedule in a renewal, and the client's procurement team will want it back fast," said Rahul Verma, Cybersecurity Sales Specialist at Singahi. "I'd sort out the breach clause first, since the client has to tell the Board without delay and is waiting on the supplier to know what happened. Sub-processors and deletion at the end of the contract come after that. Most of it can be written down now."

The guide, "Processing personal data for Indian clients: the DPDP questions you will be asked", covers 12 questions on the contract, security, breaches, rights and erasure, the supplier's own sub-processors, and audit. Each question cites the section of the Act or the Rule behind it and is mapped to ISO/IEC 27701, the international standard for privacy information management. On logging, for example, the Rules' own illustration is a company that hosts customer records with a cloud provider: it has to make sure the provider keeps the data and logs for a year before erasing them.

Nothing in the Act or the Rules requires a Data Processor to be certified to ISO 27701. Clients classed as Significant Data Fiduciaries must appoint an independent data auditor and carry out a Data Protection Impact Assessment and an audit every twelve months, and those auditors will want evidence from the processors that handle the data.

Its last section lists seven documents a supplier should have ready before the questionnaire comes, the processing agreement first. Clients compare them with each other. A 24-hour breach notice promised in the agreement won't hold up if the incident procedure sitting next to it allows 72 hours.

It links to Singahi's ISO 27701 toolkit: 43 plain-language guides to the standard's clauses and controls, each with a free Control Pack of templates, such as a procedure for customer data processing agreements.

Read the guide.

About Singahi

Singahi helps growing companies prove security to customers, investors and regulators. One team for compliance, testing, and managed security. Singahi is headquartered in Lucknow, India, with representatives in Bengaluru, Noida and Chandigarh.

Rahul Verma
Singahi Technologies Private Limited
+91 95802 30300
media@singahi.com

The DPDP questions clients ask data processors (ISO 27701)