Failed Projects, Contracts and Official Sources
ERP data protection in India: DPDP Act and Rules, CERT-In and RBI data rules
What the DPDP Act 2023 and phased DPDP Rules 2025, CERT-In's 6-hour incident reporting and RBI payment data rules mean for choosing and running an ERP.
An ERP holds personal data about employees, customers and suppliers' contacts, so your business is a data fiduciary under the Digital Personal Data Protection Act, 2023, and the ERP vendor is generally a data processor acting on your instructions. The DPDP Rules, 2025 were notified on 13 November 2025 and are coming into force in phases: the Data Protection Board provisions applied at once, the consent manager provisions from 13 November 2026, and most obligations on businesses (notice, security safeguards, breach intimation, retention and rights of individuals) from 13 May 2027 under the original timetable. Separately, CERT-In's directions of April 2022 already require reporting of specified cyber incidents within six hours. This guide explains what to require from an ERP vendor in light of these rules; it is general information, not legal advice.
This guide belongs to why ERP projects fail and how to avoid it.
DPDP: who is responsible for what
| Role | Who, in an ERP context | Main obligations under the Act and Rules |
|---|---|---|
| Data fiduciary | Your business | Lawful basis (consent or a legitimate use), notice, purpose limitation, accuracy, reasonable security safeguards, breach intimation, erasure when no longer needed, grievance redressal |
| Data processor | ERP vendor, hosting provider, implementation partner with data access | Processes only under a valid contract and on your instructions |
| Data principal | Employees, customers, contacts | Rights to information, correction, erasure, grievance redressal and nomination |
Processing employee data for employment purposes is one of the "certain legitimate uses" in the Act, but security, retention and breach obligations still apply. Customer data used for marketing generally needs consent.
Penalties
The Schedule to the Act sets penalties up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify a breach, among others. Amounts are imposed by the Data Protection Board after inquiry, considering factors such as the nature and gravity of the breach.
What to require from an ERP vendor
| Requirement | Why | Contract or feature |
|---|---|---|
| Role-based access and two-factor login | Limit who sees payroll and customer data | Feature, tested in demo |
| Encryption in transit and at rest | Reasonable security safeguard | Security documentation |
| Access logs and monitoring | Detect and investigate incidents | Feature; log retention period stated |
| Breach notification to you without delay | You must inform the Board and affected individuals | Data processing terms with a short stated time |
| Sub-processor list and notice of changes | You stay accountable for processors | Data processing terms |
| Data location and back-up location | Your own policies; Companies Act back-up rule for companies | Contract |
| Deletion on request and at contract end | Erasure and retention obligations | Feature and contract |
| Export of an individual's data | Requests from data principals | Feature |
| Cooperation with audits | Demonstrating compliance | Contract |
Add these to the ERP selection and contract checklist and the contract clauses in the SaaS contract guide.
CERT-In: six-hour reporting and log retention
CERT-In's directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, apply to service providers, intermediaries, data centres, body corporates and government organisations. Key points:
- Report specified types of cyber security incidents (for example targeted scanning, compromise of critical systems, unauthorised access, data breaches and data leaks, ransomware) to CERT-In within six hours of noticing them or being told about them.
- Keep logs of ICT systems securely for a rolling 180 days within Indian jurisdiction, and provide them to CERT-In when asked.
- Synchronise system clocks with the time servers of NIC or NPL, or sources traceable to them.
- Designate a point of contact to interface with CERT-In.
For an ERP buyer this means: know who reports an incident on the vendor's side, how fast the vendor tells you, and whether logs of the systems holding your data meet the retention requirement. Check the latest directions and FAQs on CERT-In.
RBI rules on payment data
- The RBI's April 2018 directive on storage of payment system data requires payment system operators (such as card networks and payment aggregators) to store payment data in India. It applies to them and their service providers, not to ordinary businesses that accept payments.
- Under the RBI's card-on-file tokenisation framework, merchants and their payment aggregators may not store customers' actual card data, other than limited data for tracking or reconciliation.
So your ERP should not store full card numbers. Integrate payments through a licensed payment aggregator or gateway and store only references and settlement data. Check current circulars on the RBI website.
A practical data-protection plan for an ERP rollout
- Map the personal data the ERP will hold: employees (payroll, bank, PAN, Aadhaar-linked data), customers, contacts.
- Minimise: do not migrate data you no longer need; limit sensitive fields to roles that need them.
- Set retention: align with statutory periods for accounts, tax and payroll, then delete.
- Contract the vendor and partner as processors with security, breach and deletion terms.
- Test access: can a storekeeper see salaries? Fix roles before go-live.
- Prepare an incident plan: who decides, who informs CERT-In within six hours where required, and, once the DPDP obligations apply, who informs the Board and affected individuals.
- Review before the DPDP obligations take full effect, using the final dates notified by MeitY.
Illustrative cost of getting it right
| Item | Illustrative cost |
|---|---|
| Role and access design during implementation | 2–3 partner days, ₹24,000–₹36,000 |
| Two-factor login (often included; sometimes a premium tier) | ₹0–₹500 per user per year |
| Legal review of data processing terms | ₹20,000–₹75,000 one-time |
| Annual access review and incident drill (internal time) | 20–30 hours |
These are small next to the cost of an incident. Include them in your TCO.
FAQ
Does DPDP require my ERP data to stay in India?
The Act allows transfers outside India except to countries the Central Government restricts by notification, and sector rules may impose stricter conditions. For companies, the Companies (Accounts) Rules separately require daily back-ups of electronic books on servers in India; see the audit trail guide.
Is my small business exempt from CERT-In reporting?
The directions apply to "body corporates" among others, which covers companies. If you are unsure whether they apply to you, ask your adviser and check the CERT-In FAQs.
Who informs employees if the ERP vendor has a breach?
You, as data fiduciary, once the obligation applies; that is why the vendor must tell you quickly. The contract should say how quickly.
Sources
- MeitY — Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- e-Gazette of India — official notifications, including G.S.R. 846(E) of 13 November 2025
- CERT-In — directions of 28 April 2022 and FAQs
- Reserve Bank of India — payment data storage and tokenisation circulars
- Ministry of Corporate Affairs — back-up of books of account in India
