Vendor and Processor Contracts Under DPDP

If a vendor mishandles personal data your business collected, the law still looks first to your business, not just the vendor. That makes vendor and processor contracts one of the most overlooked pieces of DPDP compliance.

Key facts at a glance

• Under DPDP, the data fiduciary (the business that decides why and how data is processed) remains accountable even when a data processor (vendor) handles the data.
• Full DPDP substantive obligations, including security and breach-notification duties, become enforceable 13 May 2027, with no stated grace period.
• Penalties for inadequate security safeguards can reach up to Rs 250 crore per instance.
• A DPDP-ready vendor contract should address scope of processing, security, breach notice, sub-processing, and erasure on termination at minimum.
• The Consent Manager registration framework under DPDP Rules 2025 becomes operational 13 November 2026.
• Vendors that predate DPDP still need their contracts reviewed; the law does not grandfather existing agreements.

Why the fiduciary carries the risk, not just the vendor

DPDP places primary legal responsibility on the entity that determines why personal data is collected and how it is used, called the data fiduciary. If that business outsources processing, say, payroll runs, customer support, or email marketing, to a third party, the third party is typically a data processor acting on the fiduciary's instructions. The fiduciary cannot simply point to the vendor's mistake and walk away; it remains accountable for ensuring the vendor handles the data properly.

This is the same logic seen in data protection regimes worldwide: outsourcing a task does not outsource legal responsibility for it.

What belongs in a DPDP-ready vendor contract

Scope and purpose of processing

The contract should spell out exactly what personal data the vendor may access, for what purpose, and for how long. Vague or open-ended access clauses ("all data reasonably necessary") make it harder to demonstrate purpose limitation later.

Security safeguards

The vendor should be contractually required to maintain reasonable technical and organisational security measures proportionate to the sensitivity of the data it handles, and to allow the fiduciary to verify this where practical.

Breach notification timelines

The contract should require the vendor to notify the fiduciary promptly, ideally within a short, specific window, of any suspected or confirmed data breach, so the fiduciary can meet its own downstream reporting obligations.

Restrictions on sub-processing

If the vendor plans to use its own sub-vendors (a common pattern in cloud and SaaS tools), the contract should require prior notice or approval, and should flow the same security and breach obligations down to the sub-processor.

Data return or erasure on termination

When the engagement ends, the contract should specify whether the vendor must return the data, delete it, or anonymise it, and within what timeframe, rather than leaving old data sitting in a decommissioned vendor's systems indefinitely.

Audit and inspection rights

Where practical, the fiduciary should retain the right to review or audit the vendor's data-handling practices, particularly for vendors handling large volumes or sensitive categories of personal data.

Comparing typical vendor relationships

A practical rollout order

Start with the vendors that handle the most sensitive or highest-volume personal data, such as payroll processors, CRM platforms, and payment partners, and update their contracts first. Lower-risk vendors, such as a one-off design agency with no ongoing data access, can follow later. Keep a simple vendor register noting which contracts have been reviewed and updated, since this register itself becomes useful evidence of a structured compliance effort if ever questioned.

If you are not sure where your business stands on vendor and data-processor risk under DPDP, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology - meity.gov.in
• Data Protection Board of India (as constituted under DPDP) - meity.gov.in
• Ministry of Corporate Affairs, for corporate contracting norms - mca.gov.in

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.