Your cloud provider may have excellent security certifications. But your organisation remains responsible for Digital Personal Data Protection (DPDP) compliance.
Section 8(1) of the DPDP Act makes the Data Fiduciary responsible for compliance in respect of personal data processing undertaken by it or on its behalf by a Data Processor.
This responsibility continues even when processing is outsourced.
For example, suppose your customer database is hosted by a cloud provider.
You still need to ensure that appropriate safeguards, access controls, retention mechanisms and breach response arrangements cover that processing.
Rule 6 also requires appropriate contractual provisions for Data Processor security safeguards.
The takeaway: Before relying on a vendor’s security certification, verify how its controls satisfy your organisation’s specific DPDP obligations.
This article is general information, not legal advice.