Industries · Software and IT services
Your clients will ask how you handle their data. Have the answer ready.
A SaaS company or an IT services firm handles two kinds of personal data. Its own: employees, candidates and sales leads. And its clients': end-user records sitting in the product's database or in environments the team supports. For client data you are usually a Data Processor, and the client will hold you to their contract.
What you hold
The personal data in a typical week
The register every duty starts from. In TrustOS each category is linked to the systems that hold it, the purposes it serves and an owner.
Data register · Software and IT services6 categories
- Client end-user data held in your product or managed systems
- Employee and contractor records
- Candidate CVs and interview notes
- Sales leads and marketing lists
- Support tickets and screen recordings
- Logs that contain personal data
Pressure points
Where the DPDP Act bites in software and it services
Security questionnaires before every deal
Enterprise buyers now send DPDP questions with their vendor assessments. Sales stalls while engineering hunts for the answers.
Acting on a client's instructions
When a client receives an erasure request, they will ask you to delete the user from your systems and confirm it. You need a reliable way to do that and prove it.
Personal data in logs and test environments
Copies of production data in staging, and names and emails in application logs, are easy to forget. The Rules expect logs to be kept for detection, but not used as a second database.
Your own sub-processors
Cloud hosting, email delivery, support tools and monitoring services all touch client data. Clients will want a list and assurance about each.
How TrustOS helps
The modules that matter most here
Separate your own data from data you process for clients, and record which client and contract each store belongs to.
When a client asks you to erase a user, run the search and deletion through a connector and send back a confirmation.
Keep your sub-processor list current, with the assessment and contract terms for each.
Answer vendor questionnaires from records you already keep, with an evidence pack that can be verified cryptographically.
What it looks like in TrustOS · sample data
An example scenario
Illustrative example: a bank's vendor review
Suppose a SaaS company selling HR software to a private bank receives a 90 question vendor assessment. In this hypothetical, the team pulls the sub-processor list, retention rules, breach procedure and recent access reviews from TrustOS, and attaches an evidence pack. The answers match what is actually in place, because they come from the same records.
Rules that sit alongside the Act
- CERT-In directions on reporting cyber incidents
- Information Technology Act, 2000 and its rules
- Data protection terms in client contracts
- Foreign laws such as the EU GDPR, where clients or users are abroad
TrustOS helps you keep these obligations in the same record. Your counsel decides how they apply to you.
Watch the film
IT and SaaS companies
Customer data in your product and your clients' data in your care: what the Act asks of software companies.
For organisations · IT and SaaS
IT and SaaS companies
Customer data in your product and your clients' data in your care: what the Act asks of software companies.
Questions
From software and it services teams
If we are only a processor, does the DPDP Act apply to us?
Most duties fall on the Data Fiduciary, your client. But clients must have a valid contract with you, and they will pass security, breach and deletion duties to you through it. Your own employee and lead data makes you a Data Fiduciary for that.
Can we use TrustOS for several clients at once?
Yes. You can keep each client's data map, requests and evidence separate, so one client never sees another's records.
We already have ISO 27001 controls. Does that help?
It helps with security safeguards. The DPDP Act also asks about purposes, notices, consent, rights and retention, which an information security programme does not usually cover.
For software and it services teams
See TrustOS run on software and it services data
Bring the systems that hold your client end-user data held in your product or managed systems, and the requests your team handles today. We will show the work moving through TrustOS, from the first request to the evidence.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.