The DPDP clauses your vendor agreements now need

Most businesses share personal data with vendors every day: cloud hosting, payroll, customer relationship tools, support desks, marketing platforms, background checks. Under the Digital Personal Data Protection Act, 2023, the business that decides why and how the data is used is the Data Fiduciary, and a vendor that processes the data on its behalf is a Data Processor. The Act puts the responsibility on the Data Fiduciary, including for what its processors do. The vendor contract is how that responsibility is managed.

What the law requires

• A valid contract. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract.
• Responsibility stays with you. Section 8(1) makes the Data Fiduciary responsible for complying with the Act for processing by it or on its behalf, whatever the contract says.
• Security safeguards. Section 8(5) requires reasonable security safeguards, including for processing by a processor, and Rule 6 requires the contract with each processor to contain them.
• Breach intimation. Section 8(6) and Rule 7 require the Data Fiduciary to notify the Data Protection Board and each affected person. You can only do that if your vendor tells you quickly.
• Erasure. Section 8(7) requires you to erase personal data when consent is withdrawn or the purpose is served, and to make your processor erase the data it holds for you.

Rules 6, 7 and 8 start in May 2027. A vendor contract signed today will usually still be running then, so it is worth getting these terms right now rather than amending every contract later.

The clauses to look for

1. Processing only on your instructions

The vendor should process the personal data only to provide the services and only on your documented instructions, not for its own purposes such as product analytics or training its own systems, unless you have agreed to it and have a basis to allow it.

2. Security safeguards

The contract should name the measures Rule 6 expects: encryption, masking or tokenisation where appropriate, access control, logging and monitoring, backups, and keeping logs for at least a year. A general promise of industry standard security is weak evidence that reasonable safeguards were in place.

3. Breach notice to you

Rule 7 expects you to tell affected people without delay and to give the Board a detailed report within 72 hours. Your vendor's notice period has to leave you time to do that. Ask for notice without undue delay and within a fixed number of hours of the vendor becoming aware, with the facts you will need: what happened, which data and which people are affected, the likely consequences and the steps taken.

4. Sub processors

Require the vendor to tell you before it adds or replaces a sub processor, to give you a chance to object, and to impose the same obligations on each sub processor while remaining responsible to you for them.

5. Erasure and return

At the end of the contract, and whenever you instruct it during the contract, the vendor should return or erase the personal data, including copies in backups within a stated period, and confirm in writing that it has done so.

6. Help with rights and grievances

People may ask you for a summary of their data, ask for correction or erasure, or raise a grievance that must be resolved within 90 days under Rule 14. If the data sits with a vendor, the contract should require the vendor to help you promptly.

7. Information, audits and evidence

You should be able to check what the vendor promises: by audit, through its certifications and reports, or through answers to a questionnaire. Choose a method that fits the vendor's size and the data involved, but keep the right.

8. Transfers outside India

The Act allows personal data to be transferred outside India except to countries the Central Government restricts by notification (Section 16), and Rule 15 allows it to set further conditions by order. The contract should say where the data will be processed and require the vendor to stop or move processing if a restriction applies.

9. Liability for the risks that matter

Check that breaches of the data protection clauses are not buried under a low liability cap. Whether a vendor will reimburse a penalty imposed on you depends on negotiation and on how far the law allows such recovery, but losses caused by the vendor's own breach, such as the cost of notifying people and third party claims, should sit outside or above the general cap.

Where to start

List the vendors that handle personal data for you, sort them by how much data they hold and how sensitive it is, and start with the contracts that renew or expire before May 2027. For new vendors, attach a standard data processing agreement or rider to the main contract, so your privacy terms stay consistent across suppliers instead of being negotiated afresh each time.