Data Processing Agreement Under the DPDP Act: The 12 Clauses Your DPA Needs, With Model Wording

When is a data processing agreement required under the DPDP Act?

Section 8(2) of the DPDP Act says a data fiduciary may engage, appoint, use or otherwise involve a data processor to process personal data on its behalf, for any activity related to offering goods or services to data principals, only under a valid contract. This section 8(2) valid contract requirement is the whole of what the Act asks. The Act does not say the contract must be in writing, must be signed separately, or must follow any template. A contract that is valid under the Indian Contract Act, 1872 is likely to satisfy section 8(2), although the Act does not define a valid contract.

The DPDP Rules, 2025 add one more point. Rule 6(1)(f) lists, among the minimum reasonable security safeguards, an appropriate provision in the contract between the data fiduciary and the data processor, wherever applicable, for taking reasonable security safeguards. So a contract that says nothing at all about security is hard to defend.

Everything else in a written DPA is recommended practice. It is still worth doing, because section 8(1) makes the data fiduciary responsible for processing done on its behalf by a processor, irrespective of any agreement to the contrary. The Act places no direct duties on the processor. If the vendor fails, the regulatory exposure lands on the customer, and the customer’s only route back to the vendor is what the contract says.

In practice, a valid contract is required under section 8(2), and a written DPA is the recommended way to meet it, whenever a vendor processes personal data on your behalf: a CRM holding customer records, a Pune payroll vendor holding salary and PAN details, a cloud host, a support desk, a call centre. As of October 2026, section 8 is scheduled to apply from 13 May 2027 under the commencement notification G.S.R. 843(E). That eighteen-month window may be shortened by notification, so check the current position. A three-year contract signed today runs well past that date.

Data processing agreement, data processing addendum or clause in the main contract

The labels vary. A data processing agreement is usually a standalone document. A data processing addendum is the same content attached to an existing master agreement, which lets you add DPDP terms without reopening price and scope. Some vendors fold the terms into their main terms of service. Under section 8(2) none of these is better in law. What matters is that the clauses below are present and that the DPA prevails over the main contract on data protection matters if the two conflict.

If you need a starting point, a data processing agreement template saves time, provided you check it against the Indian Act rather than the EU GDPR. Many templates in circulation are GDPR documents with the country changed. ClauseAudit publishes a free data processing addendum template built for the DPDP Act, and you can also see our guides on data fiduciary vs data processor roles and on section 8 for the background.

The 12 clauses a data processing agreement needs: a data processing agreement India checklist

The table sets out each clause, its basis, the risk if it is missing and short model wording. "Law" means the Act or Rules require the underlying outcome; "recommended practice" means the clause helps you meet the Act but is not itself required. Treat the wording as a starting point for negotiation, not finished drafting.

Roles, instructions and the security schedule

Clause 1 labels the parties. The Act defines a data fiduciary in section 2(i) as the person who determines the purpose and means of processing, and a data processor in section 2(k) as a person who processes on its behalf. The label does not decide the role, the facts do, but a clear statement prevents argument later. Processing only on documented instructions is a concept borrowed from Article 28 of the GDPR. It is not a DPDP requirement, but it is the clearest way to show that the vendor is a processor and not deciding its own purposes.

Clause 3 should attach a security schedule that tracks Rule 6(1). The minimum list in the Rule is: encryption, obfuscation, masking or virtual tokens; access control to computer resources; logs, monitoring and review to detect unauthorised access; continuity measures such as backups; retention of those logs and personal data for one year; the contract provision itself; and appropriate technical and organisational measures. A schedule that names each item, and the vendor’s actual control for it, is far more useful than a promise of "industry standard security".

How fast must a data processor report a breach under the DPDP Rules?

The law sets no deadline for a processor to tell its customer. Rule 7 places the breach duties on the data fiduciary. On becoming aware of a breach, the fiduciary must inform each affected data principal without delay, and must inform the Data Protection Board without delay with a description, then within 72 hours of becoming aware send a detailed report covering the facts, causes, mitigation, findings on who caused it, remedial steps and the intimations given to individuals. The Board may allow longer on a written request.

The fiduciary’s clock arguably starts when it becomes aware, which is why the contractual notice period matters so much. A vendor that may take "a reasonable time" to tell you leaves you exposed. A contractual window of 24 to 48 hours is common and is recommended practice, not law. Clause 5 then makes the vendor supply the Rule 7(2)(b) information and updates, and stops it from contacting your users or the Board on its own. See our guide on DPDP breach notification for the full Rule 7 process.

Erasure, the one-year log rule and sub-processors

Section 8(7)(b) requires the fiduciary to cause its processor to erase personal data made available to it, once consent is withdrawn or the purpose is no longer served, unless the law requires retention. Section 6(6) adds that on withdrawal of consent the fiduciary must, within a reasonable time, cause its processors to stop processing. A DPA should give the vendor a fixed period to act on both instructions.

Erasure has a floor. Rule 6(1)(e) requires logs and personal data to be kept for one year for detecting and investigating unauthorised access, and Rule 8(3) requires personal data, traffic data and processing logs, including processing by a processor, to be kept for at least one year from the date of processing. Illustration Case 2 to Rule 8 uses a cloud provider as the example. A DPA that requires immediate deletion of everything at termination can therefore conflict with the Rules. The fix is to delete operational data promptly and keep the logs for the year, then erase them.

Sub-processors matter because of section 11(1)(b). A data principal may ask the fiduciary for the identities of all other data fiduciaries and data processors with whom her data has been shared, with a description of the data. If your vendor passes data to a hosting company, an email service and an offshore support team, you need that list to answer. Clause 7 should require a current list, advance notice of changes, equivalent terms flowed down, and the vendor’s liability for each sub-processor.

Data principal requests, children’s data and data location

Sections 11 to 14 give individuals rights to access, correction, completion, updating, erasure, grievance redressal and nomination. Rule 14(3) requires the fiduciary to publish a grievance response period of not more than ninety days. Most of the data sits with vendors, so clause 8 should require assistance within a fixed number of days and should not let the vendor charge for routine requests at its discretion.

If any children’s data may pass through the service, clause 9 is law in substance. Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising directed at children, with Rule 10 setting out the consent process and Rule 12 and the Fourth Schedule exempting certain classes and purposes from sections 9(1) and 9(3) only. An edtech or paediatric platform should not accept a vendor that profiles all users without excluding children.

On location, section 16 lets the Central Government restrict transfers to countries it notifies; otherwise the Act does not prohibit transfer outside India. As of October 2026 no such restriction is known to have been notified. Rule 15 allows transfer subject to any requirements the government specifies about making data available to a foreign state. Sectoral rules, such as RBI payment data localisation, still apply. If you are or may become a significant data fiduciary, Rule 13(4) allows the government to require specified data to stay in India, so the DPA should let the vendor comply.

Audit, liability, indemnity, term and survival

Audit rights back up section 8(1). A sensible clause accepts the vendor’s independent security reports and questionnaires as the default, with an on-site or remote audit once a year and after any breach.

Liability is where most DPAs fail in practice. The Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. The Data Protection Board imposes these only where it finds a breach significant after an inquiry, and section 33(2) requires it to weigh factors such as gravity, duration, mitigation and proportionality. Penalties fall on the fiduciary. Whether a regulatory penalty can be recovered from a vendor under an indemnity is not settled in Indian law, so a separate, higher cap for data protection breaches and an indemnity for third-party claims are more dependable than relying on penalty recovery. See our guide on DPDP penalties.

Finally, term and survival. The DPA should last as long as the vendor holds any personal data, including the one-year log period, and the confidentiality, security, breach and erasure clauses should survive termination.

What can a vendor reasonably push back on?

Vendors receive these documents from every customer, and some customer drafts go further than the law or common sense. A Bengaluru SaaS company acting as processor can reasonably ask for the following, without weakening the customer’s compliance.

• A breach notice period that runs from confirmation of a breach, not from the first alert, with an initial notice inside 24 to 72 hours and updates after; demanding notice within one hour of any suspicion is rarely workable.
• Audits by independent report first, with on-site audits limited to once a year, on notice, at the customer’s cost unless a material failure is found.
• Notice of sub-processor changes with a right to object, rather than prior written consent for each change.
• Erasure that respects the one-year log floor in Rule 8(3) and any other legal retention duty.
• A higher, separate cap for data breaches rather than unlimited liability, and no indemnity for penalties caused by the customer’s own instructions.
• Assistance with data principal requests at no charge for routine volumes, with reasonable fees for bulk or unusual requests.

Why check your data processing agreement with ClauseAudit before 13 May 2027?

Under section 8(1) the customer answers for its vendor’s processing, whatever the contract says. The Schedule allows penalties of up to ₹250 crore for security failures. Many vendor contracts and DPAs signed before November 2025 are likely to say nothing about the DPDP Act, and some that do were adapted from GDPR templates.

There are three honest ways to check one. An advocate’s review is thorough and the right choice for material deals, but it takes time and costs more. A free checklist is fast, but you still have to read every clause yourself and decide whether it meets the test. ClauseAudit’s DPDP Compliance Check is an AI-assisted review that reads every clause of a vendor agreement, DPA or SaaS terms in minutes, for ₹999 per contract plus GST. Each finding is labelled either as required by the Act or Rules, with the section or rule, or as recommended practice. You get the clause quoted, why it matters, a suggested fix, a redline and a negotiation email. You choose your side, customer or vendor, and the document is not stored after the review.

It is not the right tool for everything. Large or sensitive deals, children’s data at scale and regulated sectors such as banking, insurance and health deserve an advocate’s review.