AI contract management for technology and SaaS companies

DPDP: processors sign under contract, and the clock is set

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The rules for consent managers take effect one year later, on 13 November 2026, and the substantive rules on notice, security, breach reporting, retention, children's data and significant data fiduciaries take effect eighteen months later, on 13 May 2027. Under rule 7 a data fiduciary must tell affected individuals of a breach without delay and the Data Protection Board within 72 hours; under section 8 of the Act the fiduciary stays responsible for processing done on its behalf and may engage a processor only under a valid contract; and the Act's highest penalty for failing to maintain reasonable security safeguards is up to ₹250 crore. A SaaS vendor is the processor in most of its customer relationships, so customer data-processing agreements will require 72-hour-compatible breach notice, retention and erasure on schedule, sub-processor flow-down and audit support, and templates need to be ready before 13 May 2027.

• IntelloContract: a DPA template and clause library with the rule 7 and section 8 terms, so the sales team sends a compliant DPA without legal redrafting each time.
• IntelloVendor: sub-processors onboarded with their own processing terms, so flow-down is evidenced, not assumed.
• IntelloComply: the 13 November 2026 and 13 May 2027 dates, breach-drill and retention-schedule obligations on the calendar with owners.

CERT-In: six hours and 180 days

The CERT-In directions of 28 April 2022, issued under section 70B of the Information Technology Act, 2000 and effective from 27 June 2022, require service providers, intermediaries, data centres and body corporates to report listed cyber incidents to CERT-In within six hours of noticing them, and to keep logs of all ICT systems for a rolling 180 days within Indian jurisdiction. Enterprise customers write both into SaaS MSAs; a vendor hosting outside India needs an India log store or an architecture that satisfies the direction.

Until DPDP bites, section 43A and ISO 27001 carry the contract

Section 43A of the IT Act, 2000 and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 remain the operative regime until the DPDP rules commence. The 2011 rules define sensitive personal data to include passwords, financial details, health conditions, biometrics and medical history, and treat an implemented and audited IS/ISO/IEC 27001 management system as reasonable security practice. That is why enterprise customers ask SaaS vendors to warrant ISO 27001 certification and a published privacy policy in the MSA.

Selling to banks, NBFCs and brokers: the regulated-entity addendum

The RBI (Outsourcing of IT Services) Directions, 2023 require every regulated entity to put audit rights over the provider and its sub-contractors, RBI access to data and infrastructure, data location in India, prior consent for sub-contracting, six-hour incident reporting and a documented exit into every IT vendor contract. SEBI's Framework for Adoption of Cloud Services by SEBI Regulated Entities of 6 March 2023 requires data to be stored and processed in India, MeitY-empanelled cloud providers, audit rights and an exit strategy. A standard SaaS MSA does not survive a bank or broker procurement without these clauses; a pre-approved regulated-entity addendum in the clause library shortens the sales cycle by weeks.

Export invoicing and electronic signature

Under the Integrated Goods and Services Tax Act, 2017, a supply of services to a recipient outside India with the place of supply outside India is an export and is zero-rated; to export without paying IGST, the supplier must first furnish a Letter of Undertaking in Form GST RFD-11 for the financial year. Cross-border order forms should state foreign-currency consideration and the offshore place of supply, and finance needs the LUT filed before the first export invoice of each year. Under section 5 of the Information Technology Act, 2000 an electronic signature satisfies a legal signature requirement, and the Second Schedule recognises Aadhaar e-KYC-based eSign; MSAs, order forms and NDAs can be signed with Aadhaar eSign or DSC, while powers of attorney, trust deeds and most negotiable instruments still need wet ink, so a signing workflow needs a document-type gate.

Why one platform

The customer DPA, the sub-processor contract, the breach obligation and the evidence belong on one record. IntelloSync keeps the contract, the vendor record, the obligation and the evidence on one repository with one permission model. IntelloContract drafts and negotiates agreements as real Word documents, routes approvals and executes with Aadhaar eSign, DSC or virtual signatures and e-stamping. IntelloVendor onboards and risk-scores third parties. IntelloComply puts statutory and contractual obligations on a calendar with owners, reminders, evidence and an audit trail. IntelloVault stores and indexes every signed document. Pricing is per module with unlimited users, and the platform is ISO/IEC 27001:2022 certified.