Data Processing Agreement in India: 10 Clauses You Can't Skip

Who this is for: procurement, legal and compliance teams who negotiate and approve contracts with vendors that handle personal data.

Under the DPDP Act, outsourcing processing does not outsource responsibility. Section 8(1) keeps the Data Fiduciary responsible for processing done on its behalf, and Section 8(2) allows a processor to be engaged only under a valid contract. Rule 6 adds that the fiduciary's security safeguards must include "appropriate provision" in that contract.

That makes the data processing agreement (DPA) the single most important tool you have to control vendor risk. It is where your legal obligations become your vendor's operational ones. For the wider vendor programme, see vendor risk management under DPDP.

The 10 clauses

1. Purpose and instructions

The processor may process personal data only on your documented instructions, and only for the purposes set out in the contract. Attach a schedule describing the processing: purposes, data categories, Data Principals, duration and locations.

Why: without it, a vendor that uses your data for its own product development or analytics can turn into a second fiduciary, and you lose control of the purpose.

2. Security safeguards

Specify the safeguards required by Rule 6: encryption, obfuscation, masking or tokenisation; access controls; logging, monitoring and review to detect unauthorised access; backups for continuity; and retention of logs for at least one year. Add any sector-specific standards you must meet.

Why: Rule 6 itself requires these provisions in the contract, and inadequate safeguards carry the Act's highest penalty, up to ₹250 crore.

3. Breach notification

Require notice of any actual or suspected personal data breach within a short, fixed window, with the information you need for Rule 7: nature, extent, timing, location, likely impact, affected data categories and approximate numbers, root cause and containment steps. Require updates as facts emerge, and cooperation with your investigation.

Why: your Rule 7 duties to notify individuals and the Board run from when you become aware. A vendor that tells you late can make you miss them. Align the window with CERT-In's 6-hour rule where it applies to the service.

4. Support for Data Principal rights

The processor must help you respond to access, correction and erasure requests, including by locating, correcting, exporting or deleting data within set timeframes, and must pass on any request it receives directly.

Why: Sections 11 and 12 require action across every system that holds the data, including your vendors'.

5. Consent withdrawal and erasure

The processor must stop processing when you notify it that consent has been withdrawn, and erase data when you instruct, including at the end of the purpose. It must confirm completion.

Why: Section 6(6) requires you to cause your processors to stop processing after withdrawal, and Section 8(7) to cause them to erase data.

6. Locations and cross-border transfers

List the locations where data is stored and accessed, including support access. Prohibit transfers to new locations without your approval, and require compliance with any Section 16 restrictions and sector localisation rules, such as RBI requirements for payment data.

Why: restrictions under Section 16, or a sector law that preserves stricter rules, can make a transfer unlawful even if the vendor's service is otherwise compliant.

7. Sub-processors

The processor may engage sub-processors only with your prior approval (specific or general with notice and a right to object), must flow down the same obligations, and remains liable for them.

Why: your data often sits two or three vendors away from the company you contracted with.

8. Return and deletion at exit

At the end of the contract, the processor must return or delete all personal data, including backups within a defined period, and certify deletion in writing, unless a law requires it to retain specific data.

Why: data left with a former vendor is still your responsibility.

9. Audit and information rights

You must be able to verify compliance through questionnaires, certifications, independent audit reports and, for critical vendors, on-site or remote audits. The processor must also provide information needed to demonstrate compliance.

Why: Section 8(1) makes you accountable. You need evidence that the vendor is doing what the contract says.

10. Regulatory cooperation and liability

The processor must cooperate with any inquiry by the Data Protection Board or other authority relating to the processing. Allocate liability and indemnities in a way that reflects your real exposure, including penalties and the cost of notifying individuals.

Why: if the Board inquires into a breach caused by a vendor, you will need their full cooperation, and you will want the cost to fall where the fault lies.

Before you sign

A contract is only as good as the vendor's ability to perform it. For critical and high-risk vendors, complete due diligence first: confirm what data they will process and where, assess their security controls, check sub-processors and breach history, and test whether they can actually support erasure and rights requests.

Common DPA mistakes

• Relying on the vendor's standard terms unread. Many omit withdrawal, rights support or fast breach notice.
• Copying a GDPR DPA without updating it. Indian breach timelines, rights and transfer rules differ.
• Vague security language. "Industry-standard security" is not a Rule 6 safeguard.
• No exit plan. Deletion and certification at termination are often forgotten.
• Signing and forgetting. A DPA without monitoring and review is a document, not a control.

How ConsentifyAI helps

ConsentifyAI links each vendor to the processing activities and data categories in your ROPA, and tracks DPA status, review dates and risk tier per vendor. When consent is withdrawn or an erasure request is approved, the platform routes the action to the vendors that hold the data and records their confirmation in the audit trail, so you can show that contractual obligations are being met in practice.