Security Checklist for Business Software (DPDP Ready)

A business software security checklist for 2026 comes down to eleven controls: HTTPS everywhere, hashed passwords with MFA on admin accounts, role-based access, encrypted data at rest, secrets kept out of code, patched dependencies, audit logs, tested backups, rate limiting, a breach-response plan, and DPDP Act consent-and-deletion workflows. If your application handles personal data of Indian users, most of these are no longer best practices — they are legal obligations under the Digital Personal Data Protection Act, 2023, with penalties that reach ₹250 crore for failing to take reasonable security safeguards.

This checklist is written for business owners, not security engineers. Each item says what the control is, why it matters commercially, and what to ask your development team — whether that is an in-house developer or an agency like NexaEx. Use it to audit software you already run, and paste it into the annexure of your next development contract.

What does the DPDP Act actually require from your software?

The Digital Personal Data Protection Act, 2023 — with its draft rules substantially finalised through 2025 — applies to virtually every Indian business that stores customer, patient, student, or employee data digitally. You are the data fiduciary; your software vendor and your cloud provider are data processors acting on your instructions. The Act's practical demands on software are concrete:

• Consent and notice: collect personal data only after clear notice of what you collect and why; consent must be as easy to withdraw as to give.
• Purpose limitation: use data only for the stated purpose — the marketing team cannot quietly reuse the KYC database.
• Reasonable security safeguards: encryption, access control, logging — the technical items in this checklist.
• Breach notification: report personal-data breaches to the Data Protection Board and affected users.
• Erasure: delete personal data when the purpose is served or consent is withdrawn — which means your software needs a working delete, not just a hide.

Penalties are tiered, with up to ₹250 crore for failure of security safeguards and up to ₹200 crore for breach-notification failures. For an SMB the realistic risk is smaller but existential all the same: a breach plus a complaint plus demonstrable negligence. The checklist below is what "reasonable security safeguards" looks like in practice.

The eleven-point checklist

Sections below expand the items owners most often get wrong.

Access control: the boring control that prevents most breaches

Most SMB data leaks are not exotic hacks; they are a shared admin password in a WhatsApp group, or an ex-employee whose login still works. Three rules fix the bulk of it:

• One person, one account. Shared logins destroy accountability and make offboarding impossible. If your software cannot support per-user accounts with roles, that is a requirement for the next version.
• Least privilege. The billing clerk sees billing. The marketing intern does not see the full customer database with phone numbers — that is exactly the export that ends up on a competitor's desk, and under DPDP it is your liability.
• A leaver checklist. The day someone exits, their accounts are disabled and shared secrets they knew are rotated. This costs nothing and closes the single most common hole we find in audits.

MFA on admin accounts deserves special mention: it is free (TOTP apps), takes an hour to enforce, and defeats the credential-stuffing attacks that hit every Indian login page daily.

Secrets, code, and the vendor problem

Your application's crown jewels are its secrets — database passwords, payment-gateway keys, WhatsApp API tokens. Two questions to ask your developer this week:

1. "Are any credentials committed in the source code?" The correct answer is no — secrets live in environment configuration or a secrets manager, never in the repository. Leaked repositories with embedded live keys remain a leading cause of cloud-account compromise.
2. "Who currently holds production credentials?" List the humans. If a former vendor is on the list, rotate everything now. Credential rotation is a mandatory step of any vendor transition — our software handover checklist treats it as a release condition for final payment, and your development contract should bind the vendor to confidentiality and breach reporting, as covered in our founder's guide to software development contracts.

While you have the developer's attention, ask when dependencies were last updated. Modern applications are 80% open-source libraries; critical vulnerabilities (Log4Shell was the famous example) arrive several times a year, and an unpatched framework is an unlocked door regardless of how good your own code is. Monthly patch cycles plus automated alerts (GitHub Dependabot is free) are the workable SMB standard.

Backups are a security control — test the restore

Ransomware turned backups from an IT chore into a survival mechanism. The standard worth paying for: daily automated backups, stored in a separate account or region from production, retained 30+ days, with a restore actually rehearsed every quarter. The restore drill is the part everyone skips and the part that matters — an untested backup is a hope, not a control. Cost context: for a typical SMB application on AWS or GCP, proper backup infrastructure adds roughly ₹1,500–₹8,000 per month — against the alternative of explaining to customers, and possibly the Data Protection Board, that the data is simply gone.

How much does "secure enough" cost an SMB?

Security spend scales with what you are protecting, but 2026 Indian market anchors help planning:

• Built-in from day one: implementing this checklist during development adds roughly 5–10% to a project's cost — on a ₹10,00,000 build, about ₹50,000–₹1,00,000. It is dramatically cheaper than retrofitting.
• Retrofit audit + fixes on an existing application: ₹75,000–₹3,00,000 depending on size and how much was neglected.
• VAPT (vulnerability assessment and penetration testing) by a third party: ₹60,000–₹2,50,000 per assessment; worth it annually for anything handling payments or health data, and often demanded by enterprise customers before they sign.
• Ongoing hygiene (patching, monitoring, log review) folds into a standard AMC at 15–20% of project value per year.

Sector overlays raise the bar further: NBFC lending platforms answer to RBI's IT outsourcing and cybersecurity directions on top of DPDP — a regime we build for in LoanKard — while clinics and hospitals handle health data that DPDP treats with special sensitivity, a core design constraint in our Clinic CRM. Budgeting a new build? Our project cost calculator includes the security line item most quotes quietly omit.

What should you do in the first 72 hours of a breach?

A breach plan that exists only in someone's head fails under pressure. Write one page now:

1. Contain — isolate the affected system, rotate credentials, preserve logs (do not wipe and reinstall; you will destroy the evidence you owe the regulator).
2. Assess — what data, how many people, is it ongoing? Your audit logs (checklist item 7) are what make this answerable.
3. Notify — DPDP requires informing the Data Protection Board and affected individuals; the draft rules push toward prompt notification, so treat 72 hours as your internal ceiling. Have the notification template drafted before you need it.
4. Remediate and document — fix the hole, record the timeline. A documented, prompt response is the difference between a regulator seeing negligence and seeing a professional operator having a bad day.

Assign an owner by name. "The IT guy" is not a name.

Turning the checklist into contract language

The cheapest way to get all of the above is to make it someone's contractual job. When commissioning software, annexe this checklist to the agreement with three sentences of obligation: the vendor implements items 1–9 as acceptance criteria, demonstrates 10–11 before go-live, and warrants that no credentials exist outside the agreed secrets store. When we deliver projects at NexaEx, this is the standard we hold ourselves to — and any competent agency should accept it without flinching. The ones who flinch are telling you something useful. You can see how this plays out in delivered systems in our case studies.

Talk to us

If you want your current software audited against this checklist — or your next build secured from the first commit — contact us or WhatsApp +91 97912 97741. We reply within 24 hours with a straight answer on where you stand and what it will cost to fix.