DPDP Gap Assessment for SaaS: Product, Vendor and Customer Data Gaps an Assessor Will Look For

A SaaS gap assessment tends to turn on things a privacy policy never mentions. A staging database loaded with real customer records. A session-replay tool quietly capturing form fields. A log bucket that keeps everything, for ever.

This guide to DPDP gap assessment for SaaS companies shows what an assessor traces, nine gaps worth testing first, and the evidence that closes each. It assumes you know the basics of the dual role, which our SaaS compliance overview covers. For the method itself, see the gap assessment guide and the evidence checklist. For the wider law, start with DPDP in India: the complete guide.

1. Three Data Paths an Assessor Traces

A SaaS business is rarely one thing in law. The Act’s duties sit with the Data Fiduciary, and Section 8(2) lets a Fiduciary engage a processor only under a valid contract. Your own signups, billing contacts and leads usually make you the Fiduciary. Customer data inside the product usually makes you a processor. Your vendors are processors to you.

The assessor does not argue about labels. They ask for different proof on each path.

2. Nine SaaS Gaps Worth Testing First

Section numbers refer to the DPDP Act, 2023 and rule numbers to the DPDP Rules, 2025. This is our working list, not an official one.

Two rows reward a closer read. On sub-processors, our posts on the data processor’s mandate and vendor risk management explain why accountability stays with you. On breach notice, the Fiduciary’s Rule 7 clock (a 72-hour detailed report to the Board) is its own, so your customer needs word from you quickly. More in breach management under the DPDP Act.

For rights requests, the point is routing and proof, which this DSR workflow guide walks through. Note that Rule 14(3) caps a grievance response at “a reasonable period not exceeding ninety days”. It is a ceiling, not a 30-day rule.

3. The Deletion Promise Versus the One-Year Log Rule

Many SaaS contracts promise deletion of customer data within 30 days of termination. Rule 6(e) separately expects logs and personal data to be kept for one year to support breach detection and investigation, unless another law says otherwise. Backups add a third clock.

The Rules do not settle how these fit, so your counsel should set your position. What an assessor wants is a decision on paper, with contract wording that matches what the system does: say, deletion from live systems in the promised window, and logs and backups expiring on a stated schedule. Our note on the one-year rule goes deeper.

4. Trace One Record Yourself

Before anyone external arrives, pick one customer record and follow it. Where does it enter, where is it copied, who receives it, can you delete it everywhere, and can you prove that you did?

5. A Worked Example

This is hypothetical, not a client case. A 60-person HR-tech SaaS is asked to follow one employee record a customer uploaded. It sits in production, as expected. Then the engineer lists a staging refresh from last quarter, a session-replay tool on the admin dashboard, and a support export in a shared drive.

Four copies. One contract promising deletion in 30 days. One deletion job. The finding is not that copies exist. It is that the promise cannot be shown. The fix starts with a copy register: each location, an owner and an expiry. A spreadsheet works at first, as this post on moving beyond it argues, until the stack changes.

6. How Much Time Is Left

Rules 3 and 5 to 16 commence on 13 May 2027, about 28 weeks from late October 2026. Some commentary says 14 May, so confirm against the Gazette. Rule-by-rule dates are in our DPDP Rules 2025 guide.

7. Where RuleExpert Fits

Software does not decide your roles or fix your staging environment. It can keep the evidence from drifting. RuleExpert’s Data Registry maps which systems hold which data, Vendor Governance keeps a processor register with agreement status and risk scoring, DSR Automation tracks requests against their deadlines, and Breach Management follows the Rule 7 clock.

For the contract gaps, there is a DPA and contract review service, and a gap assessment service if you want a guided pass. If you are comparing tools, our buyer’s guides to DPDP compliance software and automation platforms list the features worth asking about. We wrote them, so read them as a vendor’s view. Start with the free DPDP Scorecard, or book a RuleExpert demo.

8. Frequently Asked Questions

What is a DPDP gap assessment for SaaS companies?

A test of a SaaS business against the DPDP Act and Rules along three paths: its own users’ data, customer data held as a processor, and vendor flows.

Is a SaaS company a Data Fiduciary or a Data Processor?

Usually both, depending on the data. Your own users’ data makes you a Fiduciary. Customer data in the tenant usually makes you a processor. Counsel should confirm each case. The complete guide to DPDP in India defines the roles in full.

What will an assessor ask a SaaS company for?

Expect a request to trace one record, plus contracts, the vendor list, log and retention settings, and the breach runbook.

Do B2B SaaS companies need consent management?

For your own users, yes where consent is your basis. For customers’ end users, the customer is usually the Fiduciary, and you follow its written instructions.

Does the DPDP Act apply to SaaS hosted outside India?

It can, where processing is connected to offering goods or services to people in India. See our cross-border transfers guide.

How long must SaaS companies keep logs?

Rule 6(e) expects logs and personal data to be retained for one year, unless another law requires a different period.

Does SOC 2 or ISO 27001 cover a DPDP gap assessment?

Partly. They help with security safeguards, not with notices, rights handling or breach intimation. See SOC 2, ISO 27001 and DPDP compared.

Who answers for a sub-processor’s failure?

The Act keeps the Fiduciary answerable even where a processor fails. Ask counsel how your contracts allocate that risk.

How long does a SaaS gap assessment take?

RuleExpert’s guide puts a single-location assessment at two to three weeks elapsed. Multi-site or cloud-heavy estates are scoped separately.

When do the DPDP Rules take effect?

Rules 1, 2 and 17 to 21 are in force. Rule 4 commences on 13 November 2026, and Rules 3, 5 to 16, 22 and 23 on 13 May 2027. Confirm against the Gazette.