Data Protection for White-Label Software Buyers
Krusam Technologies Pvt. Ltd., based in Hyderabad, India, sells ready white-label applications with complete source code to businesses in India and selected markets outside the EU, EEA and UK. You run the software under your brand on hosting you choose, so your data stays under your control and your local privacy law applies to how you use it.
Planning information, not legal advice. Last reviewed November 2026. How Krusam handles enquiries is covered in our Privacy Policy.
What Do You Get to Support Compliance?
Complete source code you can review
Every Krusam product is a ready white-label application for web and mobile, sold with complete source code and 100% ownership of your copy, so your team or auditor can inspect how data is handled and change it.
Hosting you choose
Deploy on infrastructure and in a country you select, including in-country hosting where your rules require it. Hosting charges are paid to your provider.
Written responsibilities
If Krusam needs access to personal data to set up or support your system, the written agreement sets the scope, instructions, security, breach notice and data return or deletion.
Localisation in scope
Notices, consent wording, language, currency, tax fields and retention settings can be confirmed in your project scope. Extra compliance features are quoted separately.
Which Data Rules Apply in Your Country?
Use this as a starting list for your legal adviser. Rules change, and sector laws can add more.
| Market | Main laws | Regulator | What to check before launch |
|---|---|---|---|
| United States | State privacy laws such as the California CCPA/CPRA; sector laws such as HIPAA and COPPA where they apply | State attorneys general and privacy agencies; the FTC and HHS for sector rules | Whether your business meets a state law's thresholds, consumer rights requests, sale or sharing opt-outs, and breach notice rules by state. Health or children's data needs sector-specific review. |
| Canada | PIPEDA; provincial laws such as Quebec's Law 25 | Office of the Privacy Commissioner of Canada and provincial regulators | Meaningful consent, breach reporting and records, and Quebec's added duties where you serve people there, including privacy assessments for transfers outside the province. |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 (PDPL); DIFC and ADGM data protection rules in those free zones | UAE Data Office, or the DIFC or ADGM commissioner | Which regime applies to your entity, consent and rights handling, cross-border transfer conditions, and any sector rules for health or financial data. |
| Saudi Arabia | Personal Data Protection Law (PDPL) and its regulations | Saudi Data & AI Authority (SDAIA) | Consent and notice wording, transfer conditions for data leaving the Kingdom, record keeping, and breach notification. Host in-country if your sector or customers require it. |
| Other Gulf countries | National laws such as Qatar's Law No. 13 of 2016, Bahrain's Law No. 30 of 2018 and Oman's Royal Decree 6/2022 | The national data protection authority in each country | Confirm the rules country by country, especially consent, transfers and any free-zone regime such as the Qatar Financial Centre. |
| Singapore | Personal Data Protection Act 2012 (PDPA) | Personal Data Protection Commission (PDPC) | Consent and purpose limits, a named data protection officer, transfer limits, and notifiable data breach duties. |
| Malaysia | Personal Data Protection Act 2010, as amended in 2024 | Personal Data Protection Commissioner | Notice and consent in the required languages, data protection officer and breach notification duties added by the 2024 amendments, and cross-border transfer conditions. |
| Indonesia | Law No. 27 of 2022 on Personal Data Protection | The authority designated under that law | Lawful basis, data subject rights, breach notification, and transfer conditions. Sector and public-service hosting rules can apply separately. |
| Japan | Act on the Protection of Personal Information (APPI) | Personal Information Protection Commission | Purpose specification, third-party provision rules, consent or equivalent safeguards for transfers abroad, and breach reporting. |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | Office of the Australian Information Commissioner (OAIC) | Whether your business is covered, a privacy policy meeting the Principles, overseas disclosure rules, and the Notifiable Data Breaches scheme. |
| New Zealand | Privacy Act 2020 | Office of the Privacy Commissioner | Information privacy principles, overseas disclosure rules, and notifiable privacy breach duties. |
| Africa | National laws such as South Africa's POPIA, the Nigeria Data Protection Act 2023 and Kenya's Data Protection Act 2019 | The national regulator, such as South Africa's Information Regulator, the NDPC or Kenya's ODPC | Registration duties, named information or protection officers, consent, and transfer conditions, which vary by country. |
| India | Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Data Protection Board of India | Itemised notice and consent, withdrawal, rights and grievance handling, security safeguards, log retention, and breach notice as the Rules take effect. |
Data Protection Questions from Buyers
Does Krusam sell to the EU or UK?
No. Krusam does not currently offer its products or services to businesses or people in the European Union, the European Economic Area or the United Kingdom.
Who is responsible for personal data when we buy Krusam software?
You are. Once you run the software for your own business, you decide how your customers' and staff data is used, so you are normally the data controller or fiduciary. Krusam acts as your processor only when it handles that data for you under a written agreement, for example during migration or support.
Does customer data leave our country when we buy from a company in India?
Not because of the purchase. Krusam is based in Hyderabad and delivers remotely, but production data stays on the hosting you choose. A cross-border transfer can arise if Krusam's team in India accesses personal data during migration or support, so agree safeguards first, or use sample data and restrict access.
Is Krusam software certified as HIPAA or DPDP compliant?
No. Software alone does not make a business compliant, and Krusam does not claim certification. Compliance depends on your configuration, hosting, notices, contracts and processes. Have your legal adviser review them against the laws that apply to you.
Can Krusam sign a data processing agreement or NDA?
Yes. When a project involves access to personal data, data processing terms can form part of the written agreement, and Krusam can sign an NDA on request. Standard contractual clauses or similar transfer terms can be reviewed where your law needs them.
Discuss Your Country's Requirements
Tell us your market, product and hosting preference, and we will confirm what fits the standard scope and what needs separate work.
Enquire on WhatsApp