Helpdesk software and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 9 min read
Your helpdesk holds every complaint, question and reply your customers send, along with the screenshots, invoices and ID copies they attach. Under India’s DPDP Act, your business is the Data Fiduciary and the helpdesk vendor is your Data Processor, so notice, security, deletion and breach reporting stay with you. Freshdesk and Zoho Desk can store an Indian account’s data in India; Zendesk’s regions don’t include India. All three can delete one person’s data permanently, but deleting a contact isn’t always the last step.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
A customer writes in about a failed refund and attaches a bank statement. Another sends a photo of their Aadhaar card to “prove” their identity. A third pastes their full address and order history into a chat. Your helpdesk keeps every one of these, tidily filed under a ticket number, for as long as nobody deletes them. With the DPDP Act’s full obligations applying from 13 May 2027, your support inbox is one of the places customer data builds up fastest.
Is any helpdesk “DPDP-compliant”?
No helpdesk makes you compliant: the DPDP Act puts the duties on your business, not on the software
You decide why customer messages are kept and how they’re used, which makes you the Data Fiduciary. The helpdesk vendor stores and processes that data on your instructions, which makes it your Data Processor. The Act requires a valid contract with any processor you use (Section 8), and you stay answerable for the data either way.
What matters is how you run support: what you ask customers to send, who can read tickets, and how long they’re kept. The differences below are about where each helpdesk stores your data and what tools it gives you for deletion and requests.
What personal data flows through a helpdesk?
Customers tell support more than they tell anyone else in your business, and most of it is unprompted
A typical helpdesk holds:
- Contact records: names, email addresses, phone numbers and company details, created automatically from the first message.
- Ticket conversations: every email, chat and reply, often with order numbers, addresses and account details written into the text.
- Attachments: screenshots, invoices, bank statements and ID copies. Customers send these without being asked, and they stay attached to the ticket.
- Calls and chats: call recordings and chat transcripts, if you run phone or live chat support through the helpdesk.
- Portal accounts and surveys: customer logins to your support portal and their satisfaction ratings and comments.
- Agent notes: private notes your team adds about a customer, which can be more personal than anything the customer wrote.
What DPDP duties does your helpdesk create?
Support is where rights requests arrive, so your helpdesk is both a store of data and the front door for requests about it
- Notice at your support forms. A contact form or support portal is a point of collection. It needs a clear notice of what you collect and why (Section 5).
- Ask only for what you need. If your agents ask customers to send ID copies to verify them, ask whether a less sensitive check, such as an order number or registered phone number, would do.
- Purpose limits. An email address given to sort out a complaint was given for that. Adding support contacts to marketing lists needs its own consent.
- Deletion on time. Closed tickets from years ago, with their attachments, are a retention failure waiting to happen. Once the purpose is over, the data has to be deleted (Section 8).
- Security. Which agents can see which tickets, who can export, and whether former agents’ logins are closed are all part of protecting the data.
- Rights requests. Customers often send requests to access, correct or delete their data through support. Have a process for recognising them and routing them, and for verifying who is asking.
- Breaches. A reply sent to the wrong customer with someone else’s attachment, or a compromised agent login, can be a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each helpdesk store your data?
Freshdesk and Zoho Desk can keep an Indian account’s data in India; Zendesk’s regions don’t include India
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your data is, because it decides which country’s servers hold your customers’ messages.
| Helpdesk | India data centre? | How the region is set |
|---|---|---|
| Freshdesk | Yes | Chosen at sign-up; moving later is through Freshdesk support |
| Zoho Desk | Yes (Mumbai, with Chennai as backup) | By your location at sign-up |
| Zendesk | No (the US, the European Economic Area, the UK, Japan and Australia) | Through the Data Center Location add-on, included on Suite Professional and higher plans |
Freshdesk
Freshdesk lets you choose an India data centre at sign-up, and separates “delete” from “delete forever”
Its data centres are in the US, the European Economic Area, the UAE, India and Australia, and you choose yours when you create the account. Customers who need to move to another region later have to contact Freshdesk support.
Freshdesk says deletion and export requests should go through an administrator, who verifies who is asking. Deleting a contact is a soft delete: the contact moves to a Deleted Contacts list and can be restored. To erase the contact’s data, including their tickets, forum posts, calls and profile, you open the contact from that list and choose Delete forever. When an agent leaves, Freshdesk permanently deletes their personal details while keeping their replies and notes.
Zoho Desk
Zoho stores Indian accounts in India, and Zoho Desk has built-in tools to export or permanently delete one person’s data
Zoho assigns each account to a data centre based on your location at sign-up. India’s are in Mumbai (primary) and Chennai (secondary), and an India-region account logs in at a zoho.in address.
For access requests, Zoho Desk can collect a person’s data from all or selected modules, matched to their email address, and export it as a CSV file to send them. For erasure, it can permanently delete their data from one or many modules. Zoho says that deletion can’t be undone, and that the record is removed from the system “after a while”, without giving a timeframe.
Zendesk
Zendesk doesn’t offer India hosting: its data centre locations are the US, the European Economic Area, the UK, Japan and Australia
You fix your account to one of them through the Data Center Location add-on, which is free on Suite Professional and higher plans but isn’t switched on automatically; you ask your account representative or Zendesk support to activate it. Without it, Zendesk says it may move an account’s data between regions without notice.
Deleting an end user in Zendesk is a soft delete: the user sits on the Deleted users page for 30 days and is then permanently deleted, and an admin can permanently delete them sooner from that page. You can’t delete an end user who still has tickets that aren’t closed. End-user deletion schedules can delete users automatically once they’ve been inactive for a period you set.
How to set up any helpdesk for the DPDP Act
The steps are the same whichever helpdesk you use; only the setting names change
- Find out where your data is storedUse the table above, then confirm for your own account.
- Add a notice to your support forms and portalSay what you collect, why, and how long you keep it.
- Stop asking for ID copies by defaultVerify customers with details you already hold, and if a document is truly needed, collect it through a method with a notice and a deletion date, not as a ticket attachment.
- Limit who sees whatUse groups and roles so agents see the tickets they handle, restrict exports, and close former agents’ access promptly.
- Set a retention rule for closed ticketsDecide how long closed tickets and their attachments stay, then delete them on schedule. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your helpdesk’s privacy settings, release notes and announcements to see what has changed.
- Know what “deleted” meansCheck whether deleting a contact is a soft delete that can be restored, and use the permanent option when an erasure request has to be final.
- Treat rights requests as their own ticket typeTag them, verify the requester, and track them to completion.
FAQ
Is Freshdesk, Zoho Desk or Zendesk DPDP-compliant?
None of them is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the helpdesk changes is where your data is stored and how much help it gives you with exports and deletion.
A customer sent their Aadhaar card in a ticket. What should I do?
Use it only for the purpose they sent it for, then delete the attachment once that’s done. If you don’t need it at all, delete it straight away and tell the customer how you’ll verify them instead.
Does deleting a contact delete their tickets?
Not always. In Freshdesk, a normal delete can be undone; Delete forever, from the Deleted Contacts list, removes the contact’s tickets, calls and profile. Check how your helpdesk handles it before you confirm an erasure request is complete.
Do I need a contract with my helpdesk vendor under the DPDP Act?
Yes. The Act requires a valid contract with any Data Processor that handles personal data for you. Check that your agreement with the vendor covers processing on your behalf, and keep a copy with your compliance records.
Will my helpdesk add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your helpdesk’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
