Saya & Associates
The EU customer asked for a DPA. What should an Indian SaaS founder check before signing?
Start with the data, not the template
An EU enterprise buyer sends its standard DPA and asks for a signature before procurement can close.
The document may look routine, but it can commit the company to controls across hosting, support, deletion, breach response, audits and subcontracting.
The first question is practical: which data does this customer put into the service, and who decides what happens to it?
Controller or processor?
Under Article 4 of the GDPR, a controller decides the purposes and means of processing. A processor processes personal data on the controller's behalf. The role follows the processing activity, not the heading in the buyer's template.
A SaaS company may process uploaded customer records on the buyer's instructions while acting as controller for its own billing and account data. One sentence calling the vendor a processor for all data can hide that difference.
Write down the actual flows: account creation, customer uploads, support tickets, analytics, backups, product telemetry and AI features. For each, note the parties, the purpose and the retention period.
Does the DPA describe the product you operate?
Where a processor acts for a controller, Article 28(3) requires a contract covering documented instructions, confidentiality, security, subprocessors, help with rights requests and breaches, deletion or return, and audit information.
Compare each clause with how the service is configured, not only with the security policy. These are the clauses where DPAs and products most often disagree:
| Clause | What to check before signing |
|---|---|
| Deletion | Can the service delete live data on request? What stays in backups, and for how long? |
| Subprocessors | Which hosting, support, analytics and AI providers can reach personal data? Article 28(2) requires the customer's prior written authorisation, and a general authorisation must let the customer object to changes. |
| Breach notice | The GDPR requires a processor to notify the controller without undue delay (Article 33(2)). A fixed 24 or 48 hours is a negotiated term. Check the team can meet it. |
| Rights requests | Who receives a request, and how fast can the team retrieve the data? |
| Audits | Can you supply the evidence promised without giving unsafe access to other customers' systems? |
If a clause needs a product change, record that dependency before promising the control.
A DPA and a transfer mechanism answer different questions
The DPA governs the controller-processor relationship. Whether EU personal data can lawfully reach an Indian provider is a separate question under Chapter V of the GDPR.
The European Data Protection Board (EDPB) treats it as a transfer when an exporter subject to the GDPR makes personal data available to an importer in a third country.
Remote access counts. Even viewing personal data on screen from India, for support or troubleshooting, can be a transfer.
The European Commission has not adopted an adequacy decision for India. Transfers to an Indian provider therefore usually rely on an Article 46 safeguard, most often the Commission's Standard Contractual Clauses (SCCs).
The SCCs come in modules. An EU customer sending data to an Indian processor typically uses Module Two, controller to processor. Clause 14 also requires the parties to assess whether local law and practice affect compliance.
Do not assume a signed DPA settles the transfer question. Do not paste SCCs into every deal either. First identify the exporter, importer, transfer, module and any supplementary measures.
The security questionnaire, DPA, transfer documents and architecture diagram should tell the same story.
Read the commercial terms beside the privacy terms
Privacy commitments are often split across the DPA, master services agreement, order form and security schedule. Read them together.
A 24-hour incident notice in one document can conflict with 72 hours in another. A deletion promise can be undercut by a broad right to retain or reuse data. A subprocessor restriction can clash with a cloud migration already planned.
Before signing, ask one person each from legal, product and security to review a one-page table of promises. Two illustrative rows:
| Promise | System that performs it | Evidence | Owner | Exception |
|---|---|---|---|---|
| Delete customer data within 30 days of termination | Production database and backups | Deletion runbook and backup rotation log | Engineering lead | Backups expire on their 35-day cycle |
| Notify incidents within 48 hours | On-call rota and incident tooling | Incident response plan and last drill report | Security lead | None |
That exercise often reveals more than another round of redlines.
Before you sign: six steps
- Map the data flows. List each flow with its parties, purpose and retention period.
- Confirm your role. Mark where you act as processor and where you act as controller.
- Test each Article 28 clause against the product. Note any clause that needs a product change first.
- Settle the transfer route. Identify the exporter, the importer, the SCC module and the transfer assessment.
- Reconcile the documents. Check the DPA, services agreement, order form and security schedule for conflicting promises.
- Prepare the evidence pack. Have the subprocessor list, data-flow diagram, retention and backup schedule, incident process and security evidence ready.
Where a buyer asks for a control you cannot yet perform, say so. Agree a realistic alternative or implementation date in writing.
Frequently asked questions
Is a DPA required under the GDPR?
Where a processor handles personal data for a controller, Article 28(3) requires a contract or other legal act containing specified terms. A DPA is the usual form of that contract.
Is an Indian SaaS company a controller or a processor?
It depends on the processing activity. It is usually a processor for data its customers upload and control, and a controller for its own account, billing and product decisions. Map each flow rather than accepting one label.
Does India have an EU adequacy decision?
No. The European Commission has not adopted an adequacy decision for India, so transfers of EU personal data to India generally need an Article 46 safeguard such as Standard Contractual Clauses.
Does signing a DPA cover international transfers?
Not by itself. The DPA governs the processing relationship; Chapter V governs the transfer. Remote access from India, including support staff viewing data, can be a transfer that needs its own mechanism.
Can we accept a 24-hour breach notification clause?
The GDPR requires a processor to notify the controller without undue delay. A fixed 24-hour period is a contractual choice. Accept it only if your detection and escalation process can meet it every time.
The takeaway
A DPA is valuable when it records an arrangement both parties can actually carry out. The signature is the end of that work, not the beginning.
For how India's own law compares, see What India's DPDP Act means for GDPR-ready companies. To discuss a specific DPA, contact Saya & Associates.
This article provides general information as at 23 September 2026. The applicable obligations depend on the parties' roles, data flows, contracts and jurisdictions. It is not legal advice.