DPDP and vendor contracts: what a data processing agreement must contain

Why the DPA carries more weight in India than the Act's wording suggests

Section 8(2) of the Digital Personal Data Protection Act, 2023 allows a Data Fiduciary to engage a Data Processor "only under a valid contract". That is the whole of the statutory instruction. Unlike the GDPR, the Act sets out no list of mandatory processor terms.

The weight comes from section 8(1). The Data Fiduciary is responsible for complying with the Act and the Rules for any processing undertaken on its behalf by a Data Processor, "irrespective of any agreement to the contrary". A contract cannot move the statutory obligation to the vendor. What it can do is give you the control, the information and the evidence you need to meet obligations that remain yours, and allocate the commercial cost when a vendor causes the failure.

So the right way to draft a DPDP data processing agreement is backwards from the fiduciary's own duties: for each obligation in the Act and Rules, ask what you need from the vendor to discharge it, and write that into the contract.

Clause 1: Roles, purpose and instructions

Name the parties as Data Fiduciary and Data Processor, describe the categories of personal data and Data Principals involved, and state the purpose for which the processor may process them. Restrict processing to that purpose and to your documented instructions.

This is the clause that makes the contract "valid" for section 8(2) in any practical sense, and it is the one most existing vendor agreements lack: a master services agreement that mentions confidentiality but never says what personal data the vendor holds, or why, gives you nothing to point to.

Clause 2: Security safeguards, the one clause the Rules require

Rule 6(1) of the Digital Personal Data Protection Rules, 2025 sets the minimum reasonable security safeguards, expressly including processing done by a Data Processor. Rule 6(1)(f) requires "appropriate provision in the contract" between the fiduciary and the processor for taking reasonable security safeguards. It is the only place the Rules spell out a contract term. The clause should oblige the processor to maintain at least the measures Rule 6(1) lists:

• encryption, obfuscation, masking or tokenisation of personal data (Rule 6(1)(a));
• access controls on the computer resources the processor uses (Rule 6(1)(b));
• logging, monitoring and review of access, sufficient to detect, investigate and remediate unauthorised access (Rule 6(1)(c));
• measures for continued processing if data is compromised, such as backups (Rule 6(1)(d));
• appropriate technical and organisational measures to make the safeguards effective (Rule 6(1)(g)).

Clause 3: Logs, and a retention period that now has a floor

Two provisions set a minimum. Rule 6(1)(e) requires logs and personal data to be retained for one year to enable detection, investigation and remediation of unauthorised access, unless another law requires otherwise. Rule 8(3) requires a fiduciary to retain personal data, associated traffic data and logs of processing done by it or by its processor for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, and then to cause them to be erased unless another law requires longer retention.

The Rules make the processor point explicit with an illustration: a company that uses a cloud provider to host customer records must ensure the provider also retains the data and associated logs for at least one year before erasure. The DPA should state the retention period, require the processor to keep logs for it, and give you a right of access to those logs on request and during an investigation.

Clause 4: Breach notification sized to your own 72-hour clock

Section 8(6) requires the fiduciary to intimate the Data Protection Board and each affected Data Principal of a personal data breach. Rule 7(2) requires intimation to the Board without delay, and then, within seventy-two hours of becoming aware of the breach, detailed information: the broad facts and reasons, mitigation measures, any findings about the person who caused it, remedial measures and a report on intimations to Data Principals.

A vendor clause that allows notification "within 72 hours" consumes the entire window. The DPA should require notification to you within a much shorter period, specify what the first notice must contain, and oblige the processor to supply, on a continuing basis, each item Rule 7(2)(b) requires you to report. Without that, you cannot complete your own filing on time.

Clause 5: Erasure, and the conflict with old termination clauses

Section 8(7) requires the fiduciary to erase personal data when consent is withdrawn or it is reasonable to assume the specified purpose is no longer served, and, under section 8(7)(b), to cause its Data Processor to erase any personal data made available to it, unless retention is necessary for compliance with law. The DPA needs an erasure obligation triggered by your instruction, with written confirmation that it has been done, covering backups and sub-processors.

Check older agreements for a clash. Many say "delete all data immediately on termination". Read against Rule 8(3), an immediate wipe of processing logs may leave you short of the one-year minimum. The cleaner drafting is to erase personal data on instruction or at the end of the purpose, retain logs for the period the Rules require, and then erase those too.

Clause 6: Sub-processors and Data Principal rights

Section 11(1)(b) gives a Data Principal the right to obtain the identities of all other Data Fiduciaries and Data Processors with whom her personal data has been shared. You cannot answer that request if your vendor's sub-processors are unknown to you. The DPA should require a current sub-processor list, advance notice of changes, and the same obligations flowed down in writing.

The processor should also be bound to help you act on correction, completion, updating and erasure requests within your own timelines. Rule 14(3) requires a grievance redressal period not exceeding ninety days, and that period has to accommodate the vendor's part of the work.

Clause 7: Where the data goes

Section 16(1) allows the Central Government to restrict transfers of personal data to countries or territories it notifies, and section 16(2) preserves any other Indian law that imposes stricter localisation, such as sectoral rules. Rule 15 adds that transfers outside India are subject to any requirements the Government specifies about making data available to a foreign State or an entity under its control.

The DPA should require the processor to disclose where data is stored and processed, give notice before moving it, and comply with any restriction notified under section 16 or Rule 15. For a Significant Data Fiduciary, Rule 13(4) can also require specified personal data and its traffic data to stay in India. That is a hard constraint on vendor architecture, so it belongs in the contract, not just in a questionnaire.

Clause 8: Audit and cooperation

Section 10 lets the Government notify Significant Data Fiduciaries, who must appoint an independent data auditor and carry out periodic Data Protection Impact Assessments and audits. Rule 13(1) makes that once in every twelve months. Even where you are not significant, the fiduciary must be able to show its safeguards work.

Give yourself a right to audit or to receive independent assurance reports, a right to information reasonably needed to demonstrate compliance, and a named contact at the vendor for data protection matters.

Liability and indemnity against the Schedule penalties

Penalties under section 33 and the Schedule are levied on the party in breach of the Act, which for processing on your behalf is usually you. The ceilings are large:

• up to ₹250 crore for failing to take reasonable security safeguards under section 8(5);
• up to ₹200 crore for failing to notify the Board or affected Data Principals of a breach under section 8(6);
• up to ₹200 crore for breach of the obligations relating to children under section 9;
• up to ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary under section 10;
• up to ₹50 crore for breach of any other provision of the Act or Rules.

What the liability clause can and cannot do

A vendor's standard liability cap, often twelve months' fees, bears no relation to those figures. Negotiate a separate, higher cap for data protection breaches caused by the processor, an indemnity for losses including regulatory costs, and an obligation to carry cyber insurance. Whether a statutory penalty itself can be recovered from a vendor under an indemnity is a question for counsel; the safer assumption is that the contract compensates you for loss but does not transfer the penalty.

Due diligence questions to ask before you sign

The DPA is only as good as the vendor behind it. Record answers to these against the vendor and the contract, so they can be revisited at renewal:

• What personal data will you hold, in which systems, and in which countries?
• Who are your sub-processors, and how will you notify us of changes?
• How are personal data encrypted or masked, at rest and in transit?
• What access logs do you keep, for how long, and how quickly can you produce them?
• How soon after detecting a breach will you notify us, and what will the first notice contain?
• How do you erase data on instruction, including from backups, and what confirmation do you give?
• Have you had a personal data breach in the last three years, and what changed afterwards?

When this has to be in place

Rules 6, 7, 8, 13 and 15 come into force eighteen months after the Rules were published, which puts them in May 2027. The Consent Manager framework under Rule 4 starts earlier, in November 2026. Renegotiating a portfolio of vendor agreements takes longer than most teams expect, which is why the inventory of processor contracts is the job to finish first.