Vendors & Third Parties
← All postsCross-Border Data Transfers Under DPDP: Where Your Data Can Go
The DPDP Act takes a permissive, negative-list approach to transfers: personal data may go outside India unless the government restricts a specific country (Section 16). Rule 15 lets the government set requirements on making data available to foreign states. But stricter sector rules still apply, including RBI's payment data localisation, and Significant Data Fiduciaries may face specified localisation. Know where every vendor stores and accesses your data.
Data Processing Agreement in India: 10 Clauses You Can't Skip
Under Section 8(2) of the DPDP Act, a Data Fiduciary may engage a processor only under a valid contract, and Rule 6 requires that contract to include security safeguards. Because the fiduciary stays liable for its processors, the contract is where you make vendors meet your obligations. A DPDP-ready data processing agreement covers instructions, security, breach notification, rights support, sub-processors, transfers, deletion, audit, regulatory cooperation and liability.
ReadThird-Party Vendor Risk Under DPDP: Your Vendor's Breach Is Your Breach
Under Section 8(1) of the DPDP Act, a Data Fiduciary is responsible for compliance even when a vendor does the processing. Processors may only be engaged under a valid contract (Section 8(2)), and Rule 6 requires security safeguards to be written into it. Withdrawals, erasure and breaches all have to flow through your vendors on time. Effective vendor risk management means knowing every vendor, tiering them by risk, contracting properly, and monitoring continuously, not just at onboarding.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.