Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

India software delivery: DPDP Act, UPI payments, GST e-invoicing and language

Scoping a software project for buyers or users in India means settling five decisions early: how the Digital Personal Data Protection Act governs consent and breach reporting, which UPI or RBI-regulated rail the checkout uses, whether invoices route through the GST Invoice Registration Portal, how Aadhaar-based identity checks fit the flow, and which language each screen ships in.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 20 Oct 2026 · 13 min read

star

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Indian law and infrastructure actually require from what Netbase can evidence about its own practice, with official sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first. If you are instead deciding where your engineering team should be based rather than scoping a product for Indian users, Vietnam vs India for software outsourcing compares that sourcing decision directly.

Contents

Who enforces data protection for an India-facing product?

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, assented on 11 August 2023) sets out how digital personal data is processed in India, balancing an individual's right to protection of personal data with the need to process it for lawful purposes. Section 18 of the Act provides for the Data Protection Board of India, a body corporate established from the date the Central Government notifies; under Section 8(6) a data fiduciary intimates a personal data breach to the Board and to each affected person, and under Section 27 the Board can direct urgent remedial measures, inquire into the breach and impose the monetary penalty the Act provides. Separately, India's Computer Emergency Response Team (CERT-In), acting under Section 70B of the Information Technology Act, directs a service provider, intermediary, data centre, body corporate or government organisation to report a qualifying cyber security incident to CERT-In within six hours of noticing it or being told about it.

None of that changes because the development team sits outside India. What changes is who is the data fiduciary for the product, who signs the data-processing terms, and who answers the Data Protection Board or CERT-In if an Indian user's data is affected by an incident. A buyer should settle those roles before discovery starts, not after a defect surfaces.

What can Netbase evidence for an India-facing brief?

Procurement and security reviewers tend to ask for the same three statements. These are the ones Netbase can give.

  • Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. The buyer maps these practices to the data fiduciary's own DPDP Act duties for an India-facing system.
  • Hours and delivery language. Netbase delivery communication is in English. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days; converted to India Standard Time (UTC+5:30), that window is 7:30-16:45, covering most of a standard Indian business day.
  • Reach. Netbase has worked with clients in 80 countries.

Which requirement sits with which decision owner?

Five separate owners usually hold the pieces of an India-facing brief, and a proposal that blurs them tends to promise more than any one team can actually check once the contract is signed.

Decision area What Indian rules and infrastructure expect What a supplier can evidence Who decides
Data protection A lawful basis for each use of personal data under the DPDP Act, and breach notice handled through the Data Protection Board's process A data processing agreement, an access matrix, a tested breach-response plan Data protection lead
Payments A UPI handle or an RBI-regulated rail at checkout, with a status check rather than an assumed failure when confirmation is slow A tested UPI flow with a card or net-banking fallback Product owner with payments provider
E-invoicing A structured business invoice carrying an Invoice Reference Number, issued through a GST Invoice Registration Portal for supplies above the notified turnover threshold A tested IRP submission and a sample signed invoice Finance systems owner
Security incidents A cyber incident affecting an India-facing system reported to CERT-In within six hours of being noticed A named incident-response contact and a rehearsed reporting path Security lead
Language Consumer journeys that work in the languages your Indian users actually read, beyond English A named copy owner and a tested translation and script-rendering workflow Localisation owner

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Which steps come before an India-facing launch?

  1. Trace personal data by purpose

    For every use the product makes of personal data, write down what is collected, who the data fiduciary is, and which lawful basis under the DPDP Act covers that specific use.

  2. Pick the payment rails

    Decide whether UPI is the primary checkout method and which RBI-regulated card or net-banking rail is the fallback when a UPI confirmation does not return in time.

  3. Connect to GST e-invoicing where it applies

    If the product bills a GST-registered Indian business above the notified turnover threshold, build or integrate a path to a GST Invoice Registration Portal and keep the Invoice Reference Number in the order record.

  4. Scope language and identity checks

    Decide which journeys ship in Hindi or a regional language at launch, name a copy owner, and add Aadhaar-based identity checks only where the product genuinely needs them.

  5. Decide go-live readiness

    Check the data map, the payment flow, the e-invoicing connection, the CERT-In reporting contact and the language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Keep the breach-response and CERT-In reporting plan rehearsed, and re-test the payment and e-invoicing integrations after any provider or rule change.

Diagram of an India-facing launch pipeline: trace personal data, pick the payment rails, connect to GST e-invoicing and scope language and identity checks, then decide readiness before launch and keep the record current
Diagram of an India-facing launch pipeline

Worked scenario: a UPI payment that does not confirm

A retailer adds UPI alongside cards so shoppers can pay straight from a banking app at checkout.

  1. UPI request sent

    The checkout sends a collect request or shows a UPI QR code carrying the order amount and a merchant reference

    Owner
    Engineering

  2. Approved in the banking app

    The customer approves the payment in their own UPI app, outside the merchant's control

    Owner
    Engineering

  3. No immediate callback

    The payment confirmation does not arrive before the checkout's wait window closes

    Owner
    Product owner

  4. Status checked

    The checkout queries the transaction status rather than assuming failure, because the bank may still confirm shortly after

    Owner
    Engineering

  5. Fallback offered

    If no confirmation arrives in the agreed window, the checkout offers a card or net-banking rail as a fresh attempt, not a second UPI charge

    Owner
    Product owner

  6. Reconciliation

    Finance matches the settlement report against orders the next working day, by merchant reference

    Owner
    Finance owner

A proposal that cannot describe steps 3 and 5, specifically what happens when a UPI confirmation does not arrive, has not yet scoped Indian payments for this product.

What has Netbase built that is relevant to an India-facing brief?

Netbase JSC's Clutch profile carries a review from Kolkata: Syed Ali, Partner, Oriental Overseas Exports (Kolkata, India), reviewing "Plug-In Customization for Export Manufacturing Company" on Clutch, 2021-01-05, rated 5.0, wrote: "They’re good listeners, are understanding, and they remember things very well."

The closest published example of mobile-first commerce capability is from West Africa: for RB Marketplace, Netbase built an English-first multi-vendor marketplace on Laravel, with a buyer storefront, vendor onboarding and seller payouts, then built the customer shopping app for Android, with iOS in the extended scope, on that marketplace's own API, including push notifications for order updates, flash sales, and back-in-stock and cost-reduction alerts; the multi-vendor marketplace and app record has the detail. The mobile commerce apps solution sets out how a mobile-first storefront and its app are scoped.

Which questions should you ask a supplier?

  • Who is the data fiduciary for this product, and who signs the data-processing terms? Expect a clear answer before contract, not during a breach.
  • What happens in your checkout when a UPI confirmation does not return? Look for a status check and a fallback, not a second charge.
  • Can you show an invoice your platform has actually submitted through a GST Invoice Registration Portal? Ask for the file and its Invoice Reference Number, not just a claim that the connection exists.
  • Who in your team would report a cyber incident to CERT-In, and within what window? A vague answer here usually means the path has not been rehearsed.
  • Who owns the Hindi or regional-language copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
  • What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

  • DPDP consent and breach-reporting duties left undecided. Signal: nobody can say who the data fiduciary is or how a real incident would be reported. Owner: the data protection lead, who should settle this before discovery starts.
  • UPI treated as a single happy path. Signal: a slow confirmation leaves an order stuck with no status check or fallback. Owner: the product owner, scoping the fallback at discovery.
  • GST e-invoicing bolted on after go-live. Signal: the Invoice Reference Number is missing from the order record and finance reconciles invoices by hand. Owner: the finance systems owner.
  • Regional-language copy treated as a late translation pass. Signal: screens ship in English only and a named reviewer never checks the Hindi or regional-language copy before release. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on the Ministry of Electronics and Information Technology's published text of the Digital Personal Data Protection Act, 2023, the National Payments Corporation of India's own description of UPI, the Reserve Bank of India's description of its payment-systems oversight, the GST e-invoicing portal, the Unique Identification Authority of India's own description of Aadhaar, and CERT-In's cyber security directions of 28 April 2022, all checked on 2026-10-19 and described as in force on that date, together with company statements and review evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping an India-facing brief. It does not decide which lawful basis, payment rail or language boundary fits your organisation; your own advisers make that call.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

Yes. What matters is who is the data fiduciary for the product and who answers the Data Protection Board if an Indian user's data is affected, regardless of where the engineering team sits.

Many Indian consumers expect UPI at checkout alongside cards, but the specific mix depends on your audience; test your own customer base before dropping either, and always design a fallback for a slow confirmation.

Not always. Many buyers ship the journeys Indian users rely on most in Hindi or a regional language and keep less-used screens in English, provided the boundary is written down and a named owner reviews the copy before each release.

It applies to business-to-business supplies once a seller's turnover crosses the notified threshold; check the current threshold and submission window with your own tax adviser before assuming a given invoice falls outside it.

Aadhaar authentication runs through UIDAI's model, in which an authentication user agency connects through an authentication service agency to UIDAI's central repository; confirm with your advisers whether your product may use it, then scope and test the check against the live flow.

CERT-In's directions require a qualifying incident to be reported within six hours of it being noticed; name the contact and rehearse the path before you need it, not during an incident.

Plan the first release

Bring your DPDP data-fiduciary decision, your UPI and fallback payment flow, your GST e-invoicing connection where it applies, your CERT-In reporting contact and your language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed across the Hanoi-to-India working day. For other Asian markets, the Singapore guide covers phased redevelopment and identity data, and the Malaysia guide covers the amended PDPA and phased e-invoicing; if your brief also reaches Latin America, the Colombia guide covers that market's own data, payment and language decisions.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your India-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project