DPDP Section 8 — Data Processor Obligations for Indian B2B SaaS

Why DPDP Section 8 matters for B2B SaaS

Most Indian B2B SaaS startups process personal data on behalf of their customers (the data fiduciaries). When the fiduciary's enterprise procurement team starts the security review of your SaaS, the first DPDP question is: 'show us your processor obligations compliance under Section 8'. Your sales cycle stalls until you have the artifacts. Building Section 8 readiness is now a sales-enablement move, not just a compliance move.

The 8 Section 8 obligations broken down

Each obligation maps to a specific artifact your fiduciaries will request:

• Obligation 1 — Written instructions: every processing activity must trace back to a written contract or instruction set. Artifact: DPA + master agreement.
• Obligation 2 — Reasonable security safeguards: same as Schedule I but applied per-fiduciary data flow. Artifact: VAPT report + security control documentation.
• Obligation 3 — Breach notification to fiduciary: typically 24-48 hours from awareness, shorter than the 72-hour Board clock. Artifact: incident response runbook + SLA-backed breach notification template.
• Obligation 4 — Access restriction: only authorised personnel can process personal data; access reviewed periodically. Artifact: access control policy + access review log.
• Obligation 5 — Return or delete on completion: when the fiduciary terminates the contract or the purpose ends, personal data must be returned (export) or deleted. Artifact: return/delete workflow + completion certificate.
• Obligation 6 — Audit support: provide reasonable access for fiduciary or their auditor to inspect your processing operations. Artifact: audit policy + standard audit response pack.
• Obligation 7 — Sub-processor authorisation: no sub-processor without fiduciary's prior authorisation (general or specific). Artifact: sub-processor list + change notification policy.
• Obligation 8 — Flow-down to sub-processors: every sub-processor contractually carries equivalent Section 8 obligations. Artifact: sub-processor DPA template.

What a DPDP-aligned DPA contains

The fiduciary-processor DPA is the master artifact. Standard contents:

• Subject matter and duration of processing
• Nature and purpose of processing
• Categories of personal data + categories of data principals
• Fiduciary obligations and rights (Section 5 + Section 7)
• Processor obligations under Section 8
• Breach notification timeline (24-48 hours processor → fiduciary, in advance of the 72-hour Board clock)
• Sub-processor authorisation policy (general or specific, change notification period)
• Return or deletion of data on contract termination
• Audit rights and frequency
• Indemnity and liability allocation

Sub-processor management — the most common gap

Most Indian B2B SaaS startups have 10-30 sub-processors (cloud provider, email service, payment gateway, analytics platform, customer support tool, etc.). DPDP requires each to be authorised by the fiduciary, contractually bound to Section 8, and listed in a sub-processor registry the fiduciary can review. The common failure mode: ad-hoc sub-processor addition without fiduciary notification, no flow-down DPAs in place, no central registry. Fix: build the sub-processor list once, get fiduciary general authorisation for the current list, set up change notification (e.g., 30 days notice before adding a new sub-processor).

Breach notification to fiduciary — the 24-48 hour clock

The fiduciary has 72 hours to notify the Data Protection Board. The processor has 24-48 hours (typically) to notify the fiduciary so the fiduciary has time to prepare the Board notification. Build the runbook: detection alert → fiduciary incident notification template → fiduciary contact roster → status update cadence → forensic evidence package handover. Test annually via tabletop exercise.

How Bachao.AI helps B2B SaaS meet Section 8

Our DPDP gap analysis for B2B SaaS includes: DPA template review against current draft DPDP rules, sub-processor list audit + flow-down DPA template, breach notification runbook authoring with 24-48 hour fiduciary clock, audit response pack template, return/deletion workflow review. The deliverable doubles as evidence pack you can hand to fiduciary procurement teams to clear DPDP review without back-and-forth.