Every Global SaaS Platform With Indian Customers Is Either a Data Fiduciary or a Data Processor Under DPDPA
The classification determines your obligations. A SaaS platform that determines the purpose and means of processing is a Data Fiduciary. A platform that processes on behalf of a Data Fiduciary is a Data Processor. Many platforms are both — depending on the data category.
Global SaaS platforms serve Indian businesses and Indian end users across every sector — HR, CRM, accounting, project management, communication, analytics, and AI. Every SaaS platform processing personal data of individuals in India falls within the scope of the DPDPA — either as a Data Fiduciary under Section 2(i) or as a Data Processor under Section 2(k).
The compliance architecture for a SaaS platform is fundamentally different from an enterprise. SaaS platforms operate in a multi-tenant environment where the same infrastructure processes data from hundreds of customers across multiple jurisdictions. DPDPA compliance cannot be bolted onto a GDPR-compliant architecture — it requires India-specific controls for consent, notice, cross-border transfers, and data retention.
Data Fiduciary or Data Processor: The Classification Problem
A SaaS platform that provides email marketing services processes personal data — email addresses, names, behavioural data — on behalf of its customer (the Data Fiduciary). For this processing, the SaaS platform is a Data Processor under Section 2(k). But the same platform also processes its own user data — login credentials, usage analytics, billing information — for its own purposes. For this processing, the platform is a Data Fiduciary under Section 2(i). Most SaaS platforms are dual-classified. The obligations differ for each classification.
Cross-Border Hosting and Multi-Tenant Architecture
A global SaaS platform may host Indian customer data on servers in the United States, Europe, or Asia-Pacific. Section 16 permits cross-border transfers to all jurisdictions except those specifically restricted. But multi-tenant architecture creates a mapping problem: if a single database instance contains data from Indian and non-Indian customers, the entire instance may be subject to DPDPA jurisdiction mapping. SaaS platforms must implement tenant-level data flow tracking to demonstrate compliance.
Key DPDPA Obligations
| Obligation | Section / Rule | Description |
|---|---|---|
| Dual classification assessment | Sections 2(i), 2(k) | Determine Data Fiduciary vs Data Processor status for each data category |
| DPA with Indian customers | Section 8(2) | DPDPA-aligned Data Processor Agreement for processing Indian customer data |
| Sub-processor governance | Section 8(2) | DPAs with every sub-processor in the chain — cloud providers, CDNs, analytics |
| Tenant-level data flow mapping | Section 16 | Per-tenant tracking of cross-border data routing for compliance verification |
| Breach notification to customers | Section 8(6) | Contractual obligation to notify Indian Data Fiduciary customers of breaches affecting their data |
Request a SaaS Platform DPDPA Compliance Assessment
A confidential assessment of your India data exposure — classification analysis, cross-border hosting compliance, DPA requirements, and sub-processor governance framework.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
Frequently Asked Questions
Is a global SaaS platform a Data Fiduciary or Data Processor under DPDPA?
Most SaaS platforms are both. When processing data on behalf of a customer (e.g. hosting customer CRM data), the platform is a Data Processor under Section 2(k). When processing its own user data (e.g. login analytics, billing), the platform is a Data Fiduciary under Section 2(i). Obligations differ for each classification.
Must a SaaS platform notify Indian customers of a data breach?
Under Section 8(6), the Data Fiduciary (the Indian customer) is responsible for notifying the Board and affected Data Principals. The SaaS platform (Data Processor) must notify the Data Fiduciary without delay so the Fiduciary can fulfil its statutory obligation. This notification obligation should be codified in the DPA.