How Software Vendors Should Respond to the Digital Personal Data Protection Act

The Digital Personal Data Protection Act (DPDPA) has reshaped methods of collection, processing, storing and securing personal data. The act majorly focuses on the responsibilities of organizations that collect personal data of individuals.

Businesses today rely on multiple third-party vendors for hosting, analytics, customer support, payment processing, CRM systems and software development. Companies share personal data to third parties to process data on their behalf. These processors are not immune to compliance obligations. Their data handling practices directly affect the organization’s compliance metric.

For software vendors, Digital Personal Data Protection Act is also a competitive requirement as organizations look for vendors that can demonstrate strong DPDPA compliance practices.

In this blog, we will uncover how software vendors should respond to the DPDPA compliance framework.

Understanding the Relationship Between DPDPA and Third-Party Vendors

Modern digital ecosystem is highly inter-dependent. There are third parties involved, including cloud hosting provider, customer support software and data analytics providers to process personal data.

According to the Digital Personal Data Protection Act:

Data Fiduciary: Acquires personal data from individuals for specific purposes
Data Processor: Processes personal data on behalf of the fiduciary when authorized

This distinction is important because software vendors generally do not own the customer data they process instead, they act as custodians entrusted with handling data securely.

For example, a cloud-based HR software provider stores employee records for its enterprise customers and while the enterprise decides the purpose of data collection, the software vendor processes and stores that data according to the customer’s instructions. The vendor here is the data processor.

Although the fiduciary remains primarily accountable under the act, any weakness in the processor’s security can expose both parties to legal, financial, and reputational consequences. As a result, software vendors must incorporate privacy compliance into their operational processes and support organizations toward compliance.

Your Duties as Vendors

Software vendors or any other third parties are recognised as essential participants of the data processing landscape, under the Digital Personal Data Protection Act. Although, data fiduciaries stand as the primary body responsible for data protection and privacy, data processors are also expected to demonstrate practices that support secure data handling operations.

Following remain basic data processing obligations under the act:

Obey Fiduciary Instructions: As a vendor, you cannot independently act or take decisions regarding any personal data operations. Software vendors can only act according to the data fiduciary’s instructions. If data processing activities are carried out without explicit authorization, it can expose both parties to regulatory consequences.
Implementation of Security Safeguards: Vendors are expected to incorporate technical and organizational measures to meet data security needs. These safeguards usually include encryption, access controls, vulnerability management, secure software development practices, continuous monitoring, backup procedures and employee awareness programmes.
Restrictions on Sub-Processors: Many software vendors rely on another chain of outsourced service providers that are referred to as sub-processors. Firstly, processors cannot appoint sub-processors without the knowledge of fiduciaries. If approved by fiduciaries, vendors should continuously monitor their data handling practices and ensure that the data is secure.
Cooperating with Data Fiduciaries: Software vendors play a role in meeting compliance requirements of organizations. They should assist organizations by supporting responses to data principal right requests, providing expected documentation during regulatory evaluations, supporting investigations following security incidents and providing timely response during breach occurrence to encourage overall compliance.
Maintaining Processing Records: Documentation is undeniably important for compliance, which suggests that data processors are also required to maintain accurate and complete records of processing activities.

Vendor Responsibilities: Data Processing Agreements

When personal data is shared with third-parties, contracts become crucial to clearly define vendor responsibilities.

A detailed Data Processing Agreement (DPA) is a pact between data fiduciaries and data processors, that defines the process of handling personal data throughout the partnership.

It is advisable to establish DPAs that address company-specific privacy and protection practices.

A well-established DPA should include core vendor duties that support data security and compliance:

Security Obligations: The DPA should include security measures that the organization is expected to implement throughout the data handling procedure.
Sub-Processor Approval: The agreement should specify that data processors are expected to obtain written approval before engaging any sub-processor that will further handle customer personal data.
Audit Rights: Customers possess the contractual right to assess or audit the processor’s compliance with documentation reviews, certifications, questionnaires, or independent audit reports.
Breach Notification: The agreement must contain the timeline within which vendors must inform the fiduciary after a personal data breach has occurred.
Indemnity Provisions: Any losses due to processor’s negligence, misconduct or any behaviour out of alignment with contractual obligations, the DPA should mention the procedure of liability allocation.
Return or Deletion of Data: The contract should state that processors are required to either securely return all personal data or permanently delete it within a specified time period.

Managing Relationships with Sub-Processors

Software vendors sometimes rely on additional service providers like cloud hosting platforms, managed infrastructure providers, customer support vendors etc. to fulfil processing requirements.

To maintain secure data processing operations, software vendors should follow these best practices:

Obtain approval from data fiduciaries before appointing and sharing any data with sub-processors
Conduct thorough due diligence by scanning sub-processor’s security posture, privacy practices and resources or tools to protect personal data before onboarding them
Sign equivalent data processing agreements with sub-processors to ensure confidentiality, security measures, breach notification and data deletion timelines
Maintain an updated inventory of all fourth parties involved, along with the categories of data they handle
Regularly evaluate sub-processor’s data management operations
Restrict sub-processors from engaging further subcontractors unless necessary

Conclusion

Digital Personal Data Protection Act compliance is a shared responsibility across the digital ecosystem. Data fiduciaries are indeed primary bodies for personal data responsibilities, but software vendors that process shared data, play an equally important role in safeguarding personal information.

Vendors should take accountability and respond to Digital Personal Data Protection Act compliance with maturity and discipline. Whether you’re an organization or a vendor, it is best to consult with cybersecurity experts like CyberNX to avoid mismanagement of data and move towards DPDPA compliance seamlessly.

Author Profile

Adam Regan: Deputy Editor

Features and account management. 7 years media experience. Previously covered features for online and print editions.

Email Adam@MarkMeets.com