DPDP Act Compliance Checklist for IT Services & Software Companies helps Indian organisations understand and meet their obligations under the Digital Personal Data Protection Act 2023. The DPDP Act applies to all organisations processing digital personal data of Indian citizens, with penalties up to ₹250 crore for violations. Enforcement is expected from May 2027 — use this tool to identify your compliance gaps and take action before the deadline.
IT services firms process personal data as both fiduciaries (for their own staff) and processors (for client delivery). Both roles are audited. Score yourself in 3 minutes.
Check each item your organisation has in place. Your progress is shown above.
Includes our client DPA rider template, the offshore delivery access-control checklist, and the one-page readiness summary format used in enterprise RFP responses.
IT services companies occupy an unusual position under the DPDP Act 2023. For client engagements — application development, infrastructure management, BPO delivery, cloud migration — the IT firm processes personal data on behalf of the client and is therefore a Data Processor with obligations under Section 8. For its own workforce — employees in HRMS, payroll, attendance, and benefits systems — the IT firm is the Data Fiduciary and must satisfy the full set of obligations: privacy notice, consent management, data minimisation, breach notification, and Data Principal rights. Most IT firms handle the processor side first because client pressure arrives first. The internal fiduciary obligations are frequently overlooked until a vendor audit or employee complaint forces the issue.
Enterprise clients — particularly those in BFSI, healthcare, and listed companies — are including DPDP compliance questions in RFP evaluations and vendor due-diligence questionnaires. The questions that appear most consistently are: (1) Do you have a signed data processing agreement (DPA) template ready? (2) How do you restrict and revoke developer access to production data? (3) What is your breach notification SLA to the client? (4) How do you handle AI tool usage with client data? (5) Can you provide training completion records for staff on this engagement? IT firms that can answer these questions with documented evidence — rather than policy assertions — are shortlisting faster and closing with fewer remediation clauses.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
