The Digital Personal Data Protection Act is now enforced, GDPR is mature, and global enterprise customers won't sign a contract without seeing your privacy posture. For Indian software companies that previously treated privacy as a legal afterthought, the rules have changed. Here's what compliance actually requires in 2026 — and what's optional theatre.
The Three Frameworks That Matter
If you build software that handles personal data in 2026, three frameworks shape your obligations:
- DPDP Act (India) — applies whenever you process personal data of people in India, or process data outside India tied to offering goods/services to Indians. Imposes notice-and-consent requirements, data principal rights, breach reporting, and significant penalties.
- GDPR (EU/UK) — applies whenever you handle data of EU or UK residents, even from India. Stricter than DPDP in several areas. Penalties scale with global revenue.
- Sectoral regulations (RBI, IRDAI, HIPAA equivalents) — additional rules for fintech, insurance, healthcare, and a few other domains.
Most growing Indian software companies need to comply with at least DPDP and GDPR. Sectoral rules apply if your customers are in those industries.
The Practical Engineering Requirements
Compliance isn't a privacy policy on the website. It's a set of technical controls baked into how your product handles data:
- Data inventory. You can produce, on demand, a list of every category of personal data you collect, where it's stored, how long, and who has access.
- Consent and purpose tracking. Every collection of personal data is tied to a stated purpose and a recorded consent (or legitimate basis). Users can withdraw consent.
- Right to access, correct, and delete. A data subject can request their data, fix wrong information, or have it permanently deleted — and you can fulfil the request within statutory timelines (30 days under DPDP, 30 days under GDPR).
- Encryption in transit and at rest. TLS everywhere, encrypted databases, encrypted backups.
- Access controls. Role-based access, principle of least privilege, audit logs for who accessed what.
- Sub-processor management. Every third-party service touching your customer data is documented, with DPAs signed.
- Breach detection and reporting. You can detect a data incident, and you have a process to notify regulators (72 hours under DPDP and GDPR) and affected users.
- Data localisation awareness. DPDP allows international transfers but the central government can restrict transfers to specific countries. Build with the flexibility to host data regionally if needed.
What B2B Customers Are Now Asking For
Enterprise procurement teams in 2026 send a standard security questionnaire before they'll buy. The recurring questions:
- Are you SOC 2 Type II or ISO 27001 certified? Roadmap if not?
- Do you have a documented information security policy?
- Where is customer data hosted and how is it encrypted?
- Can you provide a list of all sub-processors?
- Do you carry cyber liability insurance?
- What is your incident response process and notification SLA?
- Will you sign a DPA on the customer's terms?
- Do you support SSO, SCIM, and audit logs?
If you can't answer these confidently, large deals stall. We've watched ₹2 crore deals collapse in week 6 of procurement because the founder didn't have a documented incident response plan ready.
The Difference Between "Compliant" and "Audit-Ready"
A lot of Indian SaaS companies claim compliance because they encrypt the database. That's not compliance. Real compliance means you can show an auditor:
- Written policies covering access, change management, incident response, vendor management
- Evidence those policies are followed (access reviews, change logs, post-incident reports)
- Technical controls implementing each policy
- Training records showing your team understands their obligations
- A risk assessment refreshed at least annually
This is documentation work, not just engineering work. Plan for it.
What This Costs to Build
For a SaaS taking compliance seriously from the ground up:
- DPDP/GDPR baseline implementation (data inventory, subject rights, encryption, logging): ₹8–25 lakhs, 6–12 weeks
- SOC 2 Type I readiness (policies, technical controls, evidence): ₹15–35 lakhs, 3–4 months, plus the audit itself
- SOC 2 Type II (12-month evidence-collection period after Type I)
- ISO 27001: similar in cost and effort to SOC 2 Type II
Smaller companies often start with a "compliance lite" implementation — the engineering controls without the formal audit — then certify when a deal requires it.
What Founders Get Wrong Most Often
- Treating the privacy policy on the website as the compliance work. It isn't.
- Believing "we're a small startup, regulators won't care." DPDP penalties scale to ₹250 crore. The regulator does not care that you're small.
- Picking sub-processors based on price without checking their compliance posture. Their gaps become your gaps.
- Storing customer data in personal cloud accounts, shared spreadsheets, or messaging tools.
- Building consent into the product as an afterthought, then needing a painful schema migration to add it.
How We Build This at Starduxe
For projects with personal data, we treat compliance as a non-negotiable layer of the architecture — not an add-on. Every database has documented data categories. Every API logs access. Every third-party integration has a DPA in place before it goes live. We don't certify our clients ourselves, but we make sure the technical foundation is ready when they choose to.
Privacy compliance is the new minimum viable trust. The companies that take it seriously now will close enterprise deals the rest will lose.