DPDP Act 2023: a hosting checklist for apps and SaaS in India
Under India's Digital Personal Data Protection Act, 2023, the business that decides why personal data is collected is the data fiduciary and stays responsible for it, even when a host stores it. Your hosting should keep each customer's data separate, protect it with reasonable security safeguards, let you delete it, help you report breaches quickly and act only on your instructions as a data processor. The twelve checks below cover the hosting side.
Who is responsible for what
If your app collects names, phone numbers, e-mail addresses, health or payment details of people in India, you are a data fiduciary. Your host is a data processor: it processes the data only on your behalf. The Act puts the duty to protect the data on you, so you need a host whose safeguards you can explain to customers and regulators.
Twelve hosting checks
- Separation. Is my data in its own database, file area and runtime, or mixed with other customers?
- Encryption. Is traffic encrypted end to end, and are backups encrypted before they leave the server?
- Access. Who at the host can reach my data, with what second factor, and is every action logged?
- Secrets. Are database passwords and API keys kept in a vault instead of in code?
- Location. Where are the database, files and backups stored? Some sectors and contracts require India.
- Backups and restore. How often are backups taken, where are they kept, and when was a restore last tested?
- Deletion. Can I delete a person's data on request, and is all my data deleted when the contract ends?
- Breach notice. How quickly will the host tell me about an incident? Indian rules also require reporting cyber incidents to CERT-In within six hours.
- Logs. Are logs kept long enough and in India, so an incident can be investigated?
- Release safety. Is code checked for leaked keys and vulnerable packages before it goes live?
- Sub-processors. Which other companies does the host use, and for what?
- Contract. Is there a written processing agreement that says the host acts only on your instructions and never uses your data for itself?
What stays your job
- A clear notice and consent before collecting personal data, with a way to withdraw consent
- Collecting only what you need, and deleting it when the purpose is over
- Verifiable parental consent for children's data
- Answering people who ask to see, correct or erase their data
How Nexovia covers the hosting side
| Check | Nexovia |
|---|---|
| Separation | Own database user, file area, vault, sign-in space and sandbox per customer |
| Encryption | TLS on every connection; backups encrypted before they leave the server |
| Access | Operators use a second factor and audited procedures; every action is logged |
| Location | Apps, databases, files and backups stored and run in India |
| Backups | Nightly, off-site in India, restore tested every week |
| Breach notice | Round-the-clock monitoring; CERT-In reporting within six hours |
| Release safety | Security check on every release; critical problems stop it |
Questions
Does the DPDP Act require data to be stored in India?
The Act itself allows transfers abroad except to countries the government restricts, but sector regulators, government buyers and many enterprise contracts require storage in India. Hosting in India removes the question.
Is my hosting provider responsible under the DPDP Act?
The data fiduciary, usually you, remains responsible. The host acts as a data processor under your contract, so choose one whose safeguards you can document.
What is the penalty for a data breach under the DPDP Act?
Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore, decided by the Data Protection Board of India. Breaches must also be notified to the Board and the affected people.
This guide is general information, not legal advice. Check the Act, the rules notified under it and your sector regulator's directions with your counsel.