Delivery platforms, code repositories, CI pipelines and ticketing tools quietly collect client data in test files, logs and screenshots. For SaaS products, you are a processor for customer tenants and must delete across every copy, including backups. Access to client systems needs named accounts, MFA and logs kept for at least a year.
The first four things to sort out
Stop production client data from being used in test and demo environments without masking.
Scan code repositories and pipelines for client data and credentials.
Design tenant deletion and backup expiry together.
Keep access logs for at least a year, and ICT logs 180 days in India.
A worked example
CTO / Engineering head
Production data found in a test environment
Week 1A scan finds a full copy of client customer records in a shared test database.
Week 1The copy is deleted and the client is told as the contract says.
Week 3A masking step is added to the pipeline that refreshes test data.
AfterNew environments cannot be created without masked data.
Evidence kept
Scan result
Deletion record
Pipeline change
Test environments should never hold real client data.
What others in the sector usually do. Many engineering leaders start by masking test data, because it removes a large pile of copies at once.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
IT services and consulting
Production data copied to laptops or test environments; Shared client credentials in team chats; Sub-contractors working under your client access
BPO and contact centre
Card numbers spoken on recorded calls; Phones and paper on the floor; Outbound calls without consent checks for Indian customers
Global capability centre
Indian customer data mixed into global data sets; Global HR systems hosted abroad; Intra-group agreements that predate DPDP
SaaS and software products
Support staff browsing customer tenants; Analytics on customer data beyond the contract; Deletion that does not reach backups
Managed services, data centres and cloud
Privileged admin access across many clients; Subscriber records kept with no access limits; Backups of client systems held for years
Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022
Short answer: Named, logged and removed at roll-off
Through named accounts, from managed devices or controlled jump servers, with multi-factor sign-in and logging. Access should be removed the day someone rolls off. Client data should stay in client systems and not be copied to laptops, internal tickets or chat.
Short answer: Mostly exempt for offshore data; security still applies
Mostly not. Section 17(1)(d) exempts processing of personal data of people outside India when you do it under a contract with a party outside India. Security safeguards and responsibility for your processors still apply. The exemption does not cover your Indian staff, Indian customers, or Indian data mixed into the same work.
Short answer: Four questions at design, then build the basics in
Ask four questions at the design stage: what personal data, why, for how long, and who sees it. Then build in what the Act assumes: a notice, consent where needed, role-based access, logs of record views, a way to delete, and a way to answer requests. Adding these after launch costs far more.
From your seat: CTO / Engineering head. Make the privacy questions part of design review, not a sign-off at the end.
Usually in more places than anyone expects: core systems, email, shared drives, laptops, vendor systems, backups, test copies, spreadsheets and paper. A simple inventory, one row per system, is the base for every other duty.
From your seat: CTO / Engineering head. Every new service should register itself in the inventory when it goes live.
Example in IT and ITeS
Separate internal systems from client delivery platforms.
Short answer: Yes, through a written backup-expiry rule
Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.
From your seat: CTO / Engineering head. Design deletion and backup expiry together.
Example in IT and ITeS
Client backups held by managed service teams must follow client retention.
What the law says
Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.
Evidence to keep
Backup retention settings
Written backup-expiry rule
Masking procedure for test data
Common mistakes
Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back
Short answer: Only those who need it, reviewed every quarter
Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.
From your seat: CTO / Engineering head. Role-based access belongs in the architecture, not in a later fix.
Example in IT and ITeS
Your own HRMS and payroll, as well as client systems.
What the law says
Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6
Steps
Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Short answer: At least one year; 180 days of ICT logs in India
Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.
From your seat: CTO / Engineering head. Log who viewed a record, not only errors.
Example in IT and ITeS
Keep logs of access to client systems, as well as your own systems.
What the law says
Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8
Steps
List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Short answer: Yes, unless a sector rule says otherwise
Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.
From your seat: CTO / Engineering head. Know which regions and support teams each service uses.
Example in IT and ITeS
Global HR and collaboration tools are often hosted abroad. Clients may restrict where their data goes.
What the law says
Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)
Steps
List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Short answer: Check every channel; children often appear where you least expect
Anyone under 18 is a child under the Act. For a child's data you need verifiable consent from a parent or lawful guardian, and you must not track, behaviourally monitor or show targeted ads to children. Some classes and purposes are exempt under Rule 12 and the Fourth Schedule, for example healthcare to the extent needed to protect the child's health, and educational institutions for their educational work.
From your seat: CTO / Engineering head. Age checks and tracking switches must be possible in the product.
Example in IT and ITeS
Usually only if a client's service involves children, or in staff dependants' records.
What the law says
Section 9 sets the duties. Rule 10 explains how to verify the parent. Rule 12 and the Fourth Schedule list the exemptions. Section 9 · Rules 10, 12 · Section 6
Steps
Find where children's data enters: customers, dependants, interns, visitors, scholarships, app sign-ups.
Decide whether an exemption in the Fourth Schedule applies to that purpose.
Where none applies, add an age question and a parent-consent step.
Switch off tracking and targeted ads for under-18 users.
Record the decision for each channel.
Evidence to keep
Channel-by-channel note on children's data
Parent-consent records
Ad and tracking settings
Common mistakes
Assuming 'we are B2B, so no children'
Using the age 13 or 16 from foreign laws
Treating a tick-box from the child as parental consent
Short answer: Required only for SDFs; good practice for high-risk changes
By law, only Significant Data Fiduciaries must do a yearly impact assessment. For everyone else it is good practice for high-risk changes: new tracking, profiling, large data sharing, children's data or moving data abroad. A short assessment before the change is cheaper than fixing it later.
From your seat: CTO / Engineering head. High-risk features need an assessment before build, not after launch.
Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to NIC or NPL time servers. Data centres, VPS, cloud and VPN providers keep specified subscriber information for five years.
Breach handling must meet the six-hour CERT-In clock and the DPDP report to the Board. Subscriber records need DPDP-level protection.
CERT-In
DPDP Act, Section 17(1)(d)
Processing of data of people outside India, under a contract with a party outside India, is exempt from most of the Act.
Tag each data set by where the people live. The exemption does not cover Indian staff or Indian customers.
MeitY
IT Act, Section 43A and SPDI Rules, 2011
Reasonable security practices for sensitive personal data, until Section 43A is omitted on 13 May 2027.
Your current ISO 27001 practices meet these today; DPDP Rule 6 takes over from May 2027.
Commercial calls and SMS to Indian numbers must follow registration and preference rules.
Outbound campaigns for Indian clients need both DPDP consent and TRAI compliance.
TRAI
Labour Codes (in force from 21 November 2025)
The four labour codes replaced older labour laws, including registers and records employers must keep.
Set retention for staff records against the new codes and state rules.
Ministry of Labour
Client contracts and foreign laws (for example GDPR for EU clients)
Clients often bind you to their own country's law through contracts and standard clauses.
These are contract duties, not Indian law, but you must meet them alongside DPDP.
Contract
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
