The privacy questions to ask before buying a SaaS tool

A software demonstration shows how quickly a team can upload customer records. Procurement also needs to ask what happens after the upload: who can see the records, which other companies receive them and how the business can correct or remove them later. Those questions are easier to resolve before the subscription becomes essential.

The depth of review should reflect the information and the work involved. A tool holding public company names presents different questions from a service handling identifiable employee documents. A small business can still make a disciplined decision without demanding an enormous questionnaire from every supplier.

As of 22 October 2026, the main DPDP business duties are scheduled for 13 May 2027 under the commencement notification. The questions below support preparation and should be combined with any currently applicable requirements.

Ask what the supplier will do with the data

Describe the intended workflow and the personal data involved. Then ask whether the supplier processes that information only to provide the instructed service or also for its own purposes. Product improvement, analytics, advertising and model training should not be hidden inside an undefined statement about improving services.

The Act’s definitions of Data Fiduciary and Data Processor turn on the actual role in determining purposes and means or processing on another’s behalf. A contract label is relevant evidence, but the business should understand the processing arrangement behind it.

A hypothetical recruitment consultancy buying scheduling software may expect candidate names and interview times to be used for appointments. If the vendor proposes an additional use of interview notes, that requires a separate assessment before the upload becomes routine.

Examine access and configuration responsibilities

Ask which controls the supplier provides and which the customer must configure. Who can export the whole dataset? Can administrators limit roles? How is supplier support access granted and recorded? What happens when an employee leaves?

The future Rule 6 safeguards include access controls, monitoring, continuity measures and appropriate processor contractual provisions. A certificate or assurance report can help evaluate the service, but it does not prove that the buyer has configured its own account correctly.

Request evidence proportionate to the service. A demonstration of the relevant setting may answer a narrow question better than a generic marketing document. Record material limitations and the person accepting or resolving them.

Follow the data beyond the advertised region

Ask about primary storage, backups, logs, support access, subprocessors and other relevant transfers. A regional hosting choice may describe only one part of the service. The buyer needs enough detail to assess the complete processing arrangement.

Future section 16 permits government restrictions on transfers to notified countries or territories and preserves more protective restrictions under other applicable law. Rules 13 and 15 add distinct provisions concerning specified Significant Data Fiduciary data and requirements relating to certain foreign-state access. Avoid assuming that a named cloud region settles every transfer question.

Record the supplier’s notification process for material changes. A procurement decision based on one subprocessor arrangement can become outdated if the service changes without an effective review route.

Test requests, incidents and exit

Ask the supplier to demonstrate how the business can locate a person’s records, correct an error and implement a justified deletion decision. Include attachments, exports and relevant downstream copies. Confirm whether the process is self-service, support-driven or subject to technical limits.

For incidents, ask what the supplier will report, how quickly it will contact the business and what evidence it can provide. Contractual timing should support the customer’s applicable reporting duties; the supplier’s standard update cycle may be too slow for a live incident.

At exit, establish what can be exported, in what format, at what cost and within what operational process. Ask how remaining records, backups and required retention are handled. A low subscription price can conceal a difficult departure if those matters are never examined.

Make the decision visible

Summarise the result in a short procurement record: intended use, data categories, supplier role, material safeguards, unresolved conditions and the approving owner. Link the relevant contract and evidence rather than copying every answer into a new archive.

If a limitation is acceptable only under a condition, state the condition. For example, the recruitment consultancy might exclude interview notes from the service until the additional use is resolved. Then ensure the configuration and staff instruction enforce that boundary.

A useful review ends with a decision the business can operate and revisit. It should explain why this service is suitable for this information and workflow, rather than treating vendor popularity as proof of legal or operational fit.