Are we responsible if a customer misuses data inside our product?

The customer is the Data Fiduciary for that data and answers for its purpose. You answer, through the contract, for processing it as instructed and keeping it secure.

Do we need consent from our customers’ end users?

No. Consent is the Fiduciary’s job. Your job is to process only on the customer’s instructions and to help them meet their obligations.

Can we host on servers outside India?

Yes, unless the country is notified as restricted under Section 16 or your customer’s sector requires localisation. Say where the data lives in your DPA.

By sector

Sector guide · SaaS

DPDP Act for SaaS companies

By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.

A SaaS company wears two hats. For its own customers, prospects and website visitors it is a Data Fiduciary. For the personal data its customers put into the product it is a Data Processor, acting under Section 8(2) on the customer’s instructions. Both hats carry obligations, and the contract between them is the instrument that makes the second one work.

From the Gevox Readiness Index: Sixteen of twenty advisor websites are missing HSTS or a Content Security Policy.

Fiduciary for your own data

Signups, billing details, support conversations, product analytics on your users, and every visitor to your marketing site: you decide the purpose and means, so you are the Data Fiduciary. Consent before tracking, a Rule 3 notice, security safeguards under Rule 6, breach intimation under Rule 7 and the Section 8(9) contact all apply exactly as they do to any business.

Processor for your customers’ data

When a customer stores their employees’ or clients’ personal data in your product, they are the Data Fiduciary and you are the Data Processor. Section 8(2) requires them to engage you under a valid contract, and Rule 6(1)(f) requires that contract to bind you to reasonable security safeguards. Section 8(1) keeps them responsible for what you do, which is why enterprise customers will ask for a Data Processing Agreement, and why having one ready is a sales asset.

Sub-processors and transfers

Your cloud host, your email provider and your support tooling are sub-processors. The customer’s notice has to describe the processing, so your DPA should list them, and your own subprocessors page should be public. Section 16 allows transfers abroad unless the destination is notified as restricted; the customer’s sector may add a stricter rule under Section 16(2).

Security is the largest penalty

Section 8(5) carries the Rs 250 crore band. Rule 6 sets the floor: encryption, access control, logging retained one year, backups, and processor contracts. On a public website the visible edge is the header set: HSTS, a Content Security Policy, X-Frame-Options and X-Content-Type-Options. The Readiness Index found sixteen of twenty advisor sites missing HSTS or CSP.

First five actions

Publish a Data Processing Agreement that meets Section 8(2) and Rule 6(1)(f), and a subprocessors page.
Fix the marketing site’s consent order and its security headers.
Write the Rule 7 breach procedure that notifies your customers fast enough for their own seventy-two hour clock.
Build erasure into the product so a customer can meet Section 8(7) for their principals.
Publish the Section 8(9) contact for your own users.

Questions people ask

Are we responsible if a customer misuses data inside our product?: The customer is the Data Fiduciary for that data and answers for its purpose. You answer, through the contract, for processing it as instructed and keeping it secure.
Do we need consent from our customers’ end users?: No. Consent is the Fiduciary’s job. Your job is to process only on the customer’s instructions and to help them meet their obligations.
Can we host on servers outside India?: Yes, unless the country is notified as restricted under Section 16 or your customer’s sector requires localisation. Say where the data lives in your DPA.