Does DPDP apply to B2B SaaS companies?

B2B teams often assume a consumer privacy law is someone else's problem. Under this framework the more accurate picture is that you hold two roles at once.

Role one: fiduciary for your own users

Your marketing site visitors, trial signups, webinar registrants and the named account holders inside customer workspaces are people whose data you collect for your own purposes: selling, onboarding, support, billing. Deciding those purposes is the definition of a Data Fiduciary, so the full duty set applies to that data: notice, safeguards, breach intimation, retention, rights machinery.

Role two: processor for customer data

The end user records your customers store in your product are processed on their behalf, under their instructions, which is the definition of a Data Processor. The framework reaches that processing differently: the fiduciary customer stays responsible, may engage you only under a valid contract, and must ensure its safeguards cover processing done on its behalf. Expect DPDP schedules in your enterprise contracts for exactly this reason, covering safeguard terms, erasure flow down, log retention parity and the breach workflow within the clocks.

Foreign SaaS serving India is reached too

The Act also applies to processing outside India connected to any activity related to offering goods or services to Data Principals within India. An offshore SaaS with Indian users is not outside the framework by geography.

What to do

Run the role checker per data flow rather than per company, and use the vendor and processor checklist from both sides: for your subprocessors, and to anticipate what your fiduciary customers will require of you. The SaaS guide maps the usual pressure points.