PineBrook Logo IconPineBrook Technologies

DPDPA for software and IT service firms

Software firms often handle personal data for their customers, and hold their own staff and user data too. Your role changes by dataset, and so do your duties.

Customer journey

  1. 1ContractPURPOSE
  2. 2Data intakeSECURITY
  3. 3Sub-processorsSHARING
  4. 4Customer requestsRIGHTS
  5. 5OffboardingRETENTION

Where SaaS and IT services gets hard

  • Two roles at once

    You may be a processor for client data and a fiduciary for your own.

  • Sub-processors

    Every tool and cloud service that touches client data is part of the chain.

  • Customer requests

    Clients will ask you to help with rights requests and deletion.

  • Staff data

    Employee data carries duties too, and is the main concern for many IT firms.

How the three stages apply

  1. Consulting

    Map each dataset and mark your role for it.

    See consulting

  2. Implementation

    Contract terms, request handling and deletion built into the product.

    See implementation

  3. Governance

    Sub-processor reviews and breach drills on a schedule.

    See governance

SaaS and IT services questions

Often both. You are a processor for data you handle for clients and a fiduciary for data you decide how to use, such as your staff and your own users.

Clear contract terms, help with rights requests and deletion, and prompt notice of any breach.

Yes. Clients will ask who else touches their data, so keep a current list.

With a data map that marks each dataset as processor or fiduciary, then your contracts.

Get the SaaS and IT checklist

One page: the duties that matter most for software and IT firms, in order.