Processing personal data for Indian clients: the DPDP questions you will be asked

If you run software, cloud, IT or outsourced services that handle personal data for Indian companies, a data protection schedule is on its way into your contracts. It may arrive as a questionnaire, a new clause at renewal or an audit request, and it will ask for evidence, not a link to your privacy policy.

Your client is not being difficult. Under India's Digital Personal Data Protection Act, 2023, your client is the Data Fiduciary and you are its Data Processor. The Act makes the client responsible for what you do with its data, whatever your contract says (section 8(1)), and lets it use you only under a valid contract (section 8(2)). The DPDP Rules, 2025 then require that contract to provide for reasonable security safeguards (Rule 6(1)(f)). This page lists the questions that follow, the provision behind each one, and the evidence that answers it, mapped to ISO 27701, the privacy standard.

The law is coming into force in stages. The provisions that set up the Data Protection Board took effect on publication in November 2025, and the consent manager provisions follow on 13 November 2026. Most of what this page covers, including security safeguards, breach reporting, erasure, the rights of the people whose data it is, and the penalties, applies from 13 May 2027, eighteen months after publication (G.S.R. 843(E) for the Act, Rule 1 of the Rules). Contracts signed or renewed before then will be written with that date in mind.

The penalties fall on your client, and the largest ones are about you. A Data Fiduciary that fails to take reasonable security safeguards, including over processing by its Data Processor, can be fined up to ₹250 crore, and up to ₹200 crore for failing to notify a personal data breach (the Schedule to the Act). Expect the security and breach questions to be the hardest.

Why your client is asking

These provisions bind your client, not you. They reach you through the contract, the questionnaire and the client's right to audit. If your client is a bank or another regulated entity, its regulator adds rules of its own; see the continuity questions banks ask their suppliers.

The contract

1. Will you sign a data processing agreement that covers DPDP?

Why they ask. The Act allows the client to use you only under a valid contract (section 8(2)), and the Rules require that contract to provide for reasonable security safeguards (Rule 6(1)(f)). Because the client stays responsible whatever the contract says (section 8(1)), it will use the contract to put the day-to-day duties on you.

What answers it. Your own data processing agreement or DPDP schedule, ready to send. It should cover what you process and why, your security measures, how quickly you report a breach, your sub-processors, how long you keep logs, how you help with rights requests, erasure or return at the end, and audit. Arriving with your own draft is faster than redlining the client's.

ISO 27701: A.2.2 Conditions for collection and processing, which includes the customer agreement (A.2.2.2), and the supplier agreement control in A.3 Organisational controls (A.3.10).

2. Will you use our data only for our purposes?

Why they ask. The Act defines a Data Fiduciary as anyone who decides the purpose and means of processing (section 2(i)). If you use a client's data for a purpose of your own, such as improving your product or training a model, you may be deciding a purpose yourself, and the consent the client collected from its customers does not cover it.

What answers it. A written list of the purposes you process each client's data for, a rule against marketing or other own use without the client's written permission, and a procedure for telling the client when one of its instructions looks unlawful.

ISO 27701: A.2.2, which covers purposes (A.2.2.3) and marketing use (A.2.2.4), and A.2.2.5 Infringing instruction.

3. What personal data do you hold for us, and where?

Why they ask. A person can ask your client for a summary of their personal data and the processing done on it, and for the identities of the Data Processors it was shared with (section 11(1)). The client cannot answer that, or assess its own risk, without knowing what you hold.

What answers it. A record of processing for each client: the categories of personal data, the systems and locations that hold them, the purpose, the retention period and the sub-processors involved.

ISO 27701: A.2.2, which covers records related to processing (A.2.2.7).

Security

4. What security safeguards protect our data?

Why they ask. Rule 6(1) sets the minimum safeguards for personal data a client holds, "including in respect of any processing undertaken by it or on its behalf by a Data Processor". They include encryption, obfuscation, masking or tokens; control over access to the computer resources the client or its Data Processor uses; logs, monitoring and review; measures to keep processing if the data is compromised; and technical and organisational measures to make all of it work. Failing here carries the Act's largest penalty, up to ₹250 crore.

What answers it. A short map from each item in Rule 6(1) to the control you run and the evidence for it: encryption at rest and in transit, access reviews, logs of privileged access, backup tests. If you run ISO 27001, your Statement of Applicability covers most of it.

ISO 27701: A.3 Technological controls, including secure authentication (A.3.23), logging (A.3.25) and cryptography (A.3.26), and access rights (A.3.9) in A.3 Organisational controls. The underlying security controls are in our ISO 27001 toolkit.

5. Do you log access to our data, and how long do you keep the logs?

Why they ask. Rule 6(1)(c) asks for visibility of who accesses personal data, through logs, monitoring and review, and Rule 6(1)(e) asks for logs and personal data to be kept for a year so unauthorised access can be investigated. Rule 8(3) separately requires personal data, traffic data and logs of processing to be kept for at least one year from the processing. The Rules' own illustration is a company that hosts customer records with a cloud provider: the company has to make sure the provider keeps the data and logs for a year before erasing them.

What answers it. What you log (who accessed which records, when and from where), where the logs are stored, a retention setting of at least one year, and evidence that someone reviews them.

ISO 27701: A.3 Technological controls, which covers logging (A.3.25).

6. If our data is lost or corrupted, can you keep processing?

Why they ask. Rule 6(1)(d) asks for reasonable measures to keep processing if the confidentiality, integrity or availability of personal data is compromised, "such as by way of data-backups".

What answers it. What you back up for the client and how often, where the backups are kept, and dated records of restore tests.

ISO 27701: A.3 Technological controls, which covers information backup (A.3.24). For recovering the whole service, see the ISO 22301 toolkit.

Breaches

7. How quickly will you tell us about a personal data breach, and what will you tell us?

Why they ask. Once the client is aware of a breach, Rule 7 requires it to tell each affected person and the Data Protection Board without delay, and to give the Board a detailed report within 72 hours. The report covers the facts, the reasons, the steps taken to reduce the risk, any findings about who caused the breach, the measures taken to stop it happening again, and the notices sent to affected people. When the breach happens at your end, the client's clock depends on how quickly you tell it. Failing to notify carries a penalty of up to ₹200 crore.

What answers it. A notification time in hours, counted from when you become aware, written into the contract and into your incident procedure, and a report template that collects what Rule 7(2) asks for. Most Indian companies also have their own duty to report specified cyber incidents to CERT-In within six hours of noticing them, under its Directions of 28 April 2022; that clock runs separately.

ISO 27701: A.3 Organisational controls, which covers incident management planning (A.3.11) and response (A.3.12).

Rights and erasure

8. Can you help us answer access, correction and erasure requests on time?

Why they ask. People can ask the client for a summary of their data and who it was shared with (section 11), and for its correction, completion, updating and erasure (section 12). The client must publish the period it takes to resolve grievances, which can be no more than ninety days (Rule 14(3)). If the data sits in your systems, the client needs you to find, correct or erase it well inside that period.

What answers it. A procedure and a turnaround time for the client's requests, and the ability to find one person's data across your systems, including logs and backups.

ISO 27701: A.2.3 and A.2.4, which cover obligations to PII principals (A.2.3.2).

9. When we ask, or the contract ends, will you erase our data, and can you prove it?

Why they ask. The client must erase personal data once consent is withdrawn or the purpose is served, and must "cause its Data Processor to erase" the data it gave it (section 8(7)). Large e-commerce, online gaming and social media platforms must also erase data after three years without contact from the person, with 48 hours' notice first (Rule 8 and the Third Schedule). Against that, Rule 8(3) requires personal data and logs of processing to be kept for at least one year.

What answers it. A documented way to return or erase a client's data on request and at the end of the contract, covering copies, temporary files and backups, with a deletion confirmation. Your retention schedule should show how erasure fits with the one-year minimum.

ISO 27701: A.2.3 and A.2.4, which cover temporary files (A.2.4.2) and the return, transfer or disposal of PII (A.2.4.3).

Your supply chain

10. Who are your sub-processors, and will you tell us before you add one?

Why they ask. The client stays responsible for processing done on its behalf (section 8(1)), and it has to be able to tell a person which Data Processors it shared their data with (section 11(1)(b)). Your cloud host, support desk software and email service may all handle the same data, so the client will want to know who else touches it.

What answers it. A current list of sub-processors with what each one does and where, a commitment to tell the client before you add or change one, and contracts that pass your obligations down to them.

ISO 27701: A.2.5.7 Sub-processor chain, which covers disclosure, engagement and change of subcontractors (A.2.5.7 to A.2.5.9).

11. Where is our data stored, and who can access it from outside India?

Why they ask. The Central Government may restrict transfers of personal data to countries it notifies (section 16(1)), and Rule 15 adds conditions on making data available to foreign states. A Significant Data Fiduciary may have to keep data the government specifies inside India (Rule 13(4)). Sector rules can go further, as RBI's do for payment system data, and the Act leaves them in place (section 16(2)).

What answers it. Every country where the client's data is stored, processed or accessed, including by support staff and sub-processors, and how you would move it if a restriction were notified.

ISO 27701: A.2.5 Sharing, transfer and disclosure, which covers the basis for transfers between jurisdictions (A.2.5.2) and the countries data can go to (A.2.5.3).

Assurance

12. Can we audit you, and are you certified to ISO 27701?

Why they ask. A Significant Data Fiduciary must appoint an independent data auditor and carry out a Data Protection Impact Assessment and an audit every twelve months (section 10 and Rule 13). Its auditor will want evidence from the processors that handle its data. Nothing in the Act or the Rules requires a Data Processor to be certified.

What answers it. Contract terms that allow audits, your own internal audit reports and, if you have one, an ISO 27701 certificate whose scope covers the service the client buys. If you are not certified, the evidence from questions 1 to 11 answers most of the same questions.

ISO 27701: 9.2 Internal audit, and all 43 guides in our ISO 27701 toolkit.

What to have ready before the questionnaire arrives

Most of the twelve questions come back to seven pieces of evidence, so it pays to have them before a client asks:

• your data processing agreement or DPDP schedule;
• a record of processing for each client;
• a map from Rule 6(1) to your security controls, or your ISO 27001 Statement of Applicability;
• log and backup settings that show at least one year of retention;
• a breach procedure with a notification time in hours, and a report template that covers what Rule 7 asks for;
• procedures for rights requests and for erasure or return, with a sample deletion confirmation;
• a list of sub-processors and where they operate.

Reviewers check that these documents agree with each other. A processing agreement that promises breach notice within 24 hours, next to an incident procedure that allows 72, is the first thing they will find.

Every guide in the ISO 27701 toolkit comes with a free Control Pack of templates for this work.

Where Singahi fits

We help growing companies answer these questionnaires with evidence rather than promises. That can mean reviewing your data processing agreement and your answers before they go to the client, assessing your gaps against the DPDP Act and ISO 27701, or getting you ready for a certification audit, with the certificate itself coming from an accredited certification body. See our GDPR and DPDP compliance service.

If a questionnaire is already on your desk, talk to a practitioner.

FAQ

Does the DPDP Act apply to my company directly?

For your clients' data, mostly through your clients: the duties sit on the Data Fiduciary and reach you through the contract. For personal data whose purpose and means you decide yourself, such as your own employees' and customers' data, you are the Data Fiduciary and the Act applies to you directly.

When do these obligations start?

The provisions that set up the Data Protection Board took effect in November 2025. The consent manager provisions follow on 13 November 2026. Most of sections 3 to 17 of the Act, which carry the duties on this page, the penalties, and Rules 3 and 5 to 16 apply from 13 May 2027.

Do we need ISO 27701 certification?

No provision requires it. It helps most when several clients ask the same questions, because one audited certificate can replace a lot of repeated evidence. ISO 27701 runs alongside ISO 27001, so if you already hold ISO 27001, much of the security evidence above already exists.

What if we also process personal data for EU clients?

GDPR Article 28 sets out what a processor contract must say, and it overlaps heavily with the questions above: documented instructions, confidentiality, security, sub-processors, help with rights requests and breaches, deletion or return at the end, and audits. One processing agreement can usually be written to cover both.

Where can I read the rules themselves?

On MeitY's website: the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the notification that sets the Act's start dates.