For: B2B SaaS businesses
The Digital Personal Data Protection Act, 2023 (“Act”) is intended to safeguard and protect digital personal data, and (inter alia) govern the manner in which it can be collected, stored, processed, transferred, and erased. The Act imposes requirements on data fiduciaries/collectors and data processors, as well as certain duties on the data subject/individual with respect to personal data.
“Personal Data” under the Act includes any digital or digitized data about an individual (including any data which can be used to identify an individual). This excludes any non-digital data, or any data which cannot be used to identify an individual in any manner (including in concert with any other data).
This document is intended to provide a summary of the obligations of B2B-based SaaS business, which arise from the Act.
An Overview
The key obligations of businesses towards complying with the Act include:
- Identify the extent of Personal Data collection, storage and processing which your business undertakes, and how much is necessary.
- Prepare notices for procuring consents from individuals whose Personal Data you collect, store, and process (including those individuals whose Personal Data has already been collected and/or is being stored or processed), specifying:
- Type/s of Personal Data you will use;
- The specific purpose/s you will use it for;
- The manner in which they can withdraw consent or raise grievances; and
- The manner in which they can make a complaint to the Data Protection Board of India.
- Maintain a record of consents procured and provide the following rights:
- Right to request for (i) summary of their Personal Data being used; and (ii) identities of parties to whom their Personal Data has been transferred;
- Right to correct, update and/or delete Personal Data (unless required to be retained for compliance with law);
- Right to redressal for grievances and complaints;
- Right to nominate another individual to exercise their rights (in the event of death or incapacity)
Action Items
While B2B SaaS platforms have limited Personal Data collection, Personal Data can still be collected and processed in case of user accounts for individuals/employees/representatives of enterprise customers. Businesses can take the following actions towards compliance with the Act:
- Data audit: Carry out an internal data audit, including identifying Personal Data collection, storage and processing requirements;
- Limit Personal Data usage: Erase or anonymize Personal Data to the extent feasible to reduce the compliance and associated risks, or limit the Personal Data points which are collected;
- Update your product to enable privacy rights: Businesses should therefore make available on the SaaS tool / platform functionalities to:
- Issue notices for procuring consent for Personal Data collection, storage and processing prior to any such collection, storage or processing. These notices can be worded in simple and clear terms so as to enable individuals to know their rights, and should include language which clearly states that consent is provided for collection, storage, and processing (including processing by third-parties); specify the purpose/s for the type or types of processing. For example – in case the processing will be done for purposes A, B and C, consent will have to procured specific for each of A, B and C; mention that consent can be withdrawn
- Request modification, correction, updating, or erasure of Personal Data. Other than any Personal Data which is necessary for providing the services (for example, corporate email IDs), all Personal Data should be subject to modification or erasure pursuant to withdrawal of consent.
- Appoint person/s who can handle complaints, grievances, or requests from individuals. This can be an individual assigned specifically for this task or a team responsible for ensuring speedy response.
- Implement technical measures to protect against and mitigate data breaches and their consequences. The Act requires fiduciaries/collectors to “take reasonable security safeguards to prevent personal data breach”, which can include cloud monitoring, penetration testing, ISO certification, etc., depending on the sensitivity and extent of Personal Data.
