ISO 27001, SOC 2, GDPR — one workspace.
You are a Fiduciary for your own data (sign-ups, employees, leads) and a Processor for your customers\' data. Each role has its own DPAs, DSR workflows, breach SLAs. Plus ISO 27001 or SOC 2 to unlock enterprise deals, plus GDPR for EU users. dcomply runs all of it from one evidence base — sales-ready by Series B.
DPIIT discount: 30% off Year 1SaaS lives under four frameworks + two auditors.
DPDP for Indian users. GDPR + CCPA for international. ISO 27001 and SOC 2 for enterprise procurement. CERT-In if the breach happens here.
Four fires that block the enterprise sale.
Dual role: Fiduciary + Processor. You are a Fiduciary for your sign-ups and employees, a Processor for your customers' data. Two sets of DPAs, two DSR workflows, two processing records.
Enterprise procurement wants SOC 2 / ISO. Not a legal must. A practical must. ISO 27001:2022 or SOC 2 Type II unlocks enterprise deals. dcomply ships the evidence engine; you hire the auditor.
Sub-processor change notices. Add a new vendor = 30-day customer notice + DPA update + register entry + acknowledgement capture. Not an email thread, a tracked distribution.
Security questionnaires eat days. VSAQ, CAIQ, SIG, custom spreadsheets. Pre-populate from the control evidence base and answer in a day.
Every SaaS module, one evidence base.
SaaS engagement from Rs 1,99,999 (60 days, pre-Series-A tier) or Enterprise (custom). Managed retainer from Rs 19,999/mo. 30% off Year 1 for DPIIT-recognised startups.
SaaS compliance in four numbers.
Questions SaaS CTOs and security leads actually ask.
B2B SaaS platforms process personal data on behalf of customers, making them Data Processors under DPDP Section 8. Obligations: written Data Processing Agreement with every customer, processing only per customer instructions, sub-processor disclosure, breach notification to customer within contractual SLA, and support for customer DSR requests. Plus ISO 27001 or SOC 2 for enterprise deals, CERT-In 6-hour breach rules, and GDPR if selling into the EU.
You are a Data Fiduciary for data you decide the purpose of: your own employees, sign-up leads, marketing contacts. You are a Data Processor for data your customers put into your product. Most SaaS is both simultaneously. dcomply supports separate processing records for each role with distinct DPAs and DSR workflows.
Not legally required, but almost every enterprise procurement now insists on one. ISO 27001:2022 is the more affordable and India-recognised option; SOC 2 Type II is preferred by US customers. dcomply's ISO 27001 and SOC 2 modules run the gap assessment, evidence collection and audit prep. Most SaaS achieves either in 4 to 6 months on the platform.
Section 8 read with DPDP Rules requires notifying customers of any new sub-processor with reasonable notice (typically 30 days). dcomply maintains a sub-processor register per tenant, auto-sends the change notification via email plus in-app plus DPA distribution list, and captures acknowledgements.
A DPDP DPA specifies purposes (limited to customer instructions), categories of data, categories of principals, retention (per customer instruction), sub-processors (with link to the maintained register), security measures, breach notification SLA, audit rights, and terms of data return and deletion on termination. dcomply's AI drafts one automatically from vendor metadata.
DPDP Section 16 allows cross-border transfer except to countries explicitly blocked by government notification. As of 2026 no country is blocked. Sector-specific rules (RBI localisation, DPDP Rules for children data, sectoral notices) may force India-only storage. dcomply flags each processing activity with a data-residency requirement.
No. dcomply is not an auditor. dcomply is the workspace that produces the evidence your SOC 2 auditor asks for. You still hire a qualified auditor for the report itself.
Same model. dcomply builds and maintains the control evidence. A certified body issues the certificate.
DPDP is Indian. GDPR is EU. Most SaaS companies with international users need both. The DSR module handles both request types in a single workflow.
Yes. Standard questionnaires (VSAQ, CAIQ, SIG) are pre-populated from your control evidence. Customers get answers in a day, not a week.
DPDP plus a basic vendor register are worth setting up from day one. SOC 2 usually starts around Series A when the first enterprise deals arrive.
Request a scope. Unlock the enterprise sale.
Pre-Series-A engagement from Rs 1,99,999 (60 days). Enterprise custom-quoted. Managed retainer from Rs 19,999/mo. 30% DPIIT discount Year 1.