DPDP Compliance for Indian SaaS: Your 2027 Deadline Plan

The short answer

If you run a SaaS or software product company in India, the obligations that actually cost money — notice and consent, reasonable security safeguards, breach reporting, children's data, data principal rights and cross-border transfer conditions — commence in mid-May 2027, eighteen months after the Digital Personal Data Protection Rules, 2025 were notified on 13–14 November 2025. Consent manager registration already commenced in November 2026. That leaves roughly six months of real engineering runway, and most of the work is product work, not paperwork.

This guide sets out what an Indian SaaS team should have built, contracted and documented before the eighteen-month tranche bites. If you want help sequencing it against your roadmap, our DPDP compliance implementation service and our India practice are built for exactly this problem. Stratgik is a technology firm, not a law firm — we implement controls and systems; your counsel interprets the law and signs off on your legal position.

The commencement timeline, in plain terms

The Ministry of Electronics and Information Technology notified the DPDP Rules, 2025 via Gazette notification G.S.R. 846(E) and brought the DPDP Act, 2023 into force on a staggered schedule. Law firm analyses of the notification, including Shardul Amarchand Mangaldas and S.S. Rana & Co., read the schedule as three tranches.

Published commentary differs on whether the eighteen-month date lands on 13 or 14 May 2027, depending on how the count runs from the Gazette date. Treat mid-May 2027 as the deadline and do not build a plan that depends on the extra day.

Rule 6: the seven safeguards your product has to implement

Rule 6(1) is the rule that turns a privacy policy into an engineering backlog. As analysed by Sansa Legal, it sets out seven minimum measures in clauses (a) to (g):

Two of these routinely break existing architectures. Clause (e) collides with log-retention settings tuned for cloud spend, and clause (f) collides with the generic "industry standard security" clause in most vendor MSAs. Both are cheaper to fix now than during an incident. A free website and security audit is a reasonable starting point if you have not mapped your current posture.

Rule 7: breach reporting runs on two clocks

Under Rule 7, a data fiduciary must notify each affected data principal without delay, and separately send the Data Protection Board an initial intimation without delay followed by a detailed report within 72 hours, extendable on request. King Stubb & Kasiva summarise the content requirements: the notice to individuals covers nature, scope, timing, probable effects, mitigation already taken and what the individual should do; the 72-hour report to the Board covers updated facts, circumstances and cause, remedial measures, findings on who caused the breach, and a summary of the notices sent.

Note the threshold. There is no materiality filter in the way GDPR has one — the drafting points towards notifying affected individuals regardless of assessed impact. And CERT-In's existing six-hour incident reporting direction continues to run in parallel on a faster clock for incidents in its scope. If your incident runbook was written for CERT-In alone, it is now incomplete. We covered the interaction in our piece on CERT-In versus DPDP Rule 7 reporting.

Rule 15: cross-border transfer is a watching brief, not a ban

Rule 15 does not name permitted or prohibited countries. As this analysis of Rule 15 sets out, the obligation is that where a fiduciary makes personal data available to a foreign State, to an entity under that State's control, or to an agency of such a State, it must meet "such requirements as the Central Government may, by general or special order, specify". Separately, Section 16(1) lets the Central Government restrict transfers to a notified country or territory.

The practical consequence for a SaaS company: you cannot finish cross-border compliance in advance, because the requirements will arrive as orders. What you can finish is the capability to respond. That means an accurate register of every cross-border data flow including sub-processors, contract clauses that require processors to implement new requirements within a fixed period, a right to suspend transfers, and someone whose job includes watching the Gazette. Significant Data Fiduciaries carry a harder version: Rule 13 restricts transfer of specified personal data and related traffic data outside India, and requires verification that algorithmic systems do not pose a risk to data principals' rights. Our guide to the Significant Data Fiduciary rules under Rule 13 goes deeper.

What non-compliance costs

The Schedule to the DPDP Act sets maximum financial penalties by category. Figures reported by King Stubb & Kasiva:

These are ceilings, not tariffs, and the Board determines quantum. The realistic near-term risk for most SaaS companies is not a maximum penalty but enterprise procurement: Indian buyers have started asking for DPDP readiness evidence in security questionnaires well ahead of May 2027, and an unanswerable questionnaire costs deals long before a regulator does.

A six-month implementation sequence

If you start now, this order front-loads the work with the longest lead times.

1. Weeks 1–3 — Data map. Every personal data field, where it is stored, which processor touches it, which flows leave India. Without this, nothing downstream is accurate.
2. Weeks 3–6 — Consent and notice. Rebuild the notice to state purposes, data categories and withdrawal mechanics in plain language, and make withdrawal as easy as giving consent. Treat consent as a versioned record, not a boolean.
3. Weeks 5–10 — Rule 6 controls. Encryption or tokenisation, access control, access logging, continuity testing, and the one-year retention change. Budget for the storage cost increase.
4. Weeks 8–14 — Data principal rights. Build access, correction and erasure as product features with an audit trail. Manual fulfilment does not scale past the first hundred requests.
5. Weeks 10–16 — Contracts. Reissue processor and sub-processor agreements with Rule 6 provisions, log retention, breach cooperation timelines and a transfer-suspension right.
6. Weeks 14–20 — Breach runbook. Rehearse the dual CERT-In and Rule 7 clocks with a tabletop exercise. Pre-draft the notice templates.
7. Weeks 18–24 — Erasure and retention automation. Purpose-expiry deletion jobs, grievance handling within ninety days, and evidence packs for buyer questionnaires.

Compliance checklist

• Data inventory complete, including non-production environments and analytics tools
• Cross-border flow register with every sub-processor named
• Notice rewritten; consent versioned, logged and withdrawable in one step
• Encryption, masking or tokenisation applied to personal data at rest, in transit and in logs
• SSO, MFA and least-privilege access across app, database, cloud and CI/CD
• Access logging retained for one year; storage cost budgeted
• Backup restore tested, with recorded RTO and RPO
• Processor contracts carry Rule 6 provisions and flow down to sub-processors
• Access, correction and erasure available as self-service product features
• Breach runbook covering CERT-In and Rule 7 clocks, rehearsed at least once
• Grievance channel with a documented ninety-day resolution process
• Named owner per control, with a review cadence and written review records
• Assessment of whether you are likely to be designated a Significant Data Fiduciary

Build it in-house or bring in help?

Most of this is ordinary engineering: schema changes, access control, logging, deletion jobs, contract templates. The hard part is sequencing it against a product roadmap without stalling the roadmap. Teams typically take one of three routes — absorb it into the existing sprint cadence, hire a compliance-literate engineering lead, or bring in a fractional CTO to own the programme for two or three days a month. If the gaps are mostly in operations and monitoring rather than product, managed technology often covers it more cheaply. If the gaps are in the product itself — consent records, rights fulfilment, retention logic — it is a custom software engagement.

Frequently asked questions

When exactly does DPDP compliance become mandatory for an Indian SaaS company?

The substantive obligations — notice and consent, security safeguards, breach reporting, data principal rights and cross-border conditions — commence with the eighteen-month tranche in mid-May 2027. Consent manager registration commenced in November 2026. Published analyses differ on whether the eighteen-month date is 13 or 14 May 2027; plan for the earlier one.

Does the DPDP Act apply to us if our customers are outside India?

The Act applies to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to data principals in India. An Indian company processing Indian users' data is squarely in scope. Whether a specific offshore arrangement is covered is a legal question for your counsel — Stratgik implements controls, it does not advise on legal interpretation. Our India technology hub sets out the wider picture.

Is ISO 27001 or SOC 2 enough to satisfy Rule 6?

No, though it helps considerably. Rule 6 does not cross-refer to ISO standards the way the old SPDI Rules did; it lists its own seven measures. An existing ISO 27001 or SOC 2 programme will already cover most of access control, logging and continuity, but the one-year log retention and the specific processor-contract provisions usually need explicit work.

Do we need to appoint a Data Protection Officer?

A DPO appointment is an obligation for Significant Data Fiduciaries, who are designated by the Central Government based on factors including data volume and sensitivity. Ordinary data fiduciaries must publish contact details for the person who can answer questions about processing, and run a grievance redressal mechanism. If you may be designated an SDF, scope for the heavier set of duties now.

What does DPDP implementation typically cost?

It varies with how much personal data your product touches and how much of the Rule 6 stack already exists. A company that already has SSO, encryption and reasonable logging is mostly doing consent records, rights fulfilment, retention automation and contracts. A company starting from shared credentials and 30-day logs is doing a platform project. Our app cost estimator gives a rough order of magnitude for the engineering portion; the DPDP compliance page explains how we scope it.

Can we be penalised before May 2027?

The penalty provisions tied to the eighteen-month tranche commence with it. The Data Protection Board exists now, and commentary notes it could issue notices or corrective directions ahead of the penalty provisions. Separately, CERT-In directions and sectoral regulators (RBI, IRDAI, SEBI) continue to apply on their own terms today.

Six months is enough time to do this properly and not enough time to do it twice. If you want an outside read on where your product actually stands against the eighteen-month tranche — and a sequenced plan that does not stop your roadmap — book a free 30-minute session with the Stratgik team. We will tell you plainly which items are engineering work, which are contract work, and which belong with your lawyers.