DPDP compliance check for your vendor contracts and DPAs.

DPDP compliance checklist: what this review checks

• Data fiduciary and data processor roles, and who decides the purpose of processing
• A valid contract with the data processor (section 8(2)), and what it should spell out
• Reasonable security safeguards provided for in the contract (Rule 6)
• Breach notification: how fast the vendor tells you, so you can meet your own Rule 7 duties
• Erasure on exit and when consent is withdrawn, including logs kept for one year
• Help with data principal rights and grievances
• Children’s data and verifiable parental consent
• Cross-border transfer of personal data and sub-processors
• Whether the clause is required by the DPDP Act or Rules, or recommended practice

Who this review is for

• Businesses sharing customer or employee data with a SaaS, cloud, payroll, CRM or support vendor
• Vendors and IT service firms asked to sign a customer’s data processing agreement
• Startups getting their contracts ready for the DPDP start date of 13 May 2027
• Edtech, gaming and consumer apps whose vendors may handle children’s data
• MSMEs, D2C and ecommerce brands, fintech and NBFC teams sharing customer data with outsourced vendors
• HR teams sharing employee data with payroll, background-check or HRMS vendors
• Founders and procurement teams without in-house counsel

How it works

1. 1

   Upload the agreement

   PDF, Word, a photo or pasted text, with its schedules and annexures.

2. 2

   Choose your side

   Tell us whether you are the customer (data fiduciary) or the vendor (data processor), because the same clause reads differently for each.

3. 3

   Read the report

   Each finding is marked as required by the DPDP Act or Rules, with the section or rule, or as recommended practice, with the clause quoted.

4. 4

   Raise the points

   A suggested redline and a polite email to the other side, phrased as questions rather than demands.

8 red flags to look for

• The vendor may use your data to improve its product or train AI

  Consent under the Act is limited to the purpose in your notice, so a vendor using the data for its own purposes may go beyond what your users agreed to.

• No fixed time for the vendor to tell you about a breach

  You must tell the Data Protection Board and affected people without delay, and send the Board a detailed report within 72 hours of becoming aware. The law sets no deadline for the vendor, so a fixed one in the contract is recommended practice.

• Only a general promise of “industry standard” security

  Rule 6 lists minimum safeguards you must take, including over your vendor, and expects a security provision in the contract. Spelling out specific measures is best practice.

• The vendor may keep your data after the contract ends

  Section 8(7) requires you to make your processor erase the data once consent is withdrawn or the purpose is served, subject to the one-year minimum for logs in Rule 8.

• Logs kept for less than a year, or not at all

  Rules 6 and 8 require personal data and processing logs, including your vendor’s, to be kept for at least one year before they are erased.

• Liability for data protection capped at a few months of fees

  From 13 May 2027 the Board can impose a penalty of up to Rs 250 crore for a significant failure to take security safeguards. A small cap leaves that risk with you.

• Sub-processors can be added freely, with no list

  A person can ask you which processors their data was shared with (section 11), which is hard to answer without a current list.

• A clause saying the vendor is responsible for your DPDP compliance

  Section 8(1) keeps the data fiduciary responsible, irrespective of any agreement to the contrary.

Terms explained

Data fiduciary

The party that decides, alone or with others, why and how personal data is processed. Usually the customer.

Data processor

A party that processes personal data on behalf of a data fiduciary. Usually the vendor.

Data principal

The person the personal data is about.

Data Protection Board

The body set up under the Act that inquires into breaches and can impose penalties.

DPA

A data processing agreement: contract terms on how a vendor handles personal data. Useful, but the Act requires only a valid contract.

Withdrawal of consent

When a person withdraws consent, the fiduciary must within a reasonable time stop processing and make its processors stop, unless the law requires or allows the processing.

Significant Data Fiduciary

A fiduciary the Government notifies as significant, which then has extra duties such as a yearly impact assessment and audit.

Section 8 of the DPDP Act

The data fiduciary’s general obligations: responsible irrespective of any agreement, a valid contract with any processor, security safeguards, breach intimation, erasure and grievance redressal.

Rule 6 security safeguards

The DPDP Rules, 2025 list minimum reasonable security safeguards, such as encryption or masking, access control, logs kept for a year, backups and a contract provision requiring the processor to take them.

Personal data breach

Any unauthorised processing, or accidental disclosure, use, alteration, loss or destruction of personal data that compromises its confidentiality, integrity or availability.

Pricing in India

One plan covers all 15 India analyzers. Prices are in rupees; any GST that applies is shown at checkout.

DPDP Compliance Check FAQs

Related India reviews