DPDP Compliance Is Due 13 May 2027. Is Your Vendor Contract Ready?

Why this is a contract problem, not only a policy problem

Organisations responding to DPDP tend to start with a privacy notice and a consent flow, which are visible and customer-facing. The harder work sits behind them, in the contracts with every vendor that touches personal data on your behalf: your CRM, your payroll provider, your support desk, your analytics tools, your cloud infrastructure.

The Act contemplates that a data fiduciary remains answerable for personal data it is responsible for, including where processing is carried out by someone else under contract. That makes the contract the instrument through which the obligation is passed down, and a contract that never mentions data protection roles is not doing that job.

What the timeline actually is

The Act was passed in 2023 and the Rules were notified on 13 November 2025. Rather than everything commencing at once, obligations phase in over a period, with the fuller set of compliance requirements expected from 13 May 2027.

The practical reading for a business is that the deadline is far enough away to plan for and close enough to matter for contracts being signed now. A three-year SaaS agreement signed today runs straight through the compliance date, which is exactly why the data protection terms in it are worth getting right at signature rather than amending later.

What a vendor contract should address

• Which party is the data fiduciary and which is the processor for each category of data.
• The purposes for which the vendor may process, and a prohibition on processing for its own purposes.
• Security obligations and a breach notification process with a defined timeline.
• Sub-processing: whether the vendor may engage others, and on what terms.
• Deletion or return of personal data on termination, and within what period.
• Cross-border transfer, since much SaaS infrastructure sits outside India.
• Assistance with data principal requests, so you can meet your own obligations.

The realistic remediation path

Auditing every vendor contract at once is not how this gets done in practice. The workable sequence is to inventory which vendors actually receive personal data, rank them by volume and sensitivity, and address the top of that list first. A payroll provider and a marketing analytics tool are not the same risk.

For contracts up for renewal, the renewal is the moment of leverage. For long-dated contracts, most enterprise vendors are issuing data processing addenda proactively because their other customers are asking, so requesting one is usually a short conversation rather than a negotiation.

A caution on precision

This is a regime that is still bedding in. The Rules were notified recently, the phasing is spread over time, and guidance continues to develop. An article can tell you the shape of the obligations and which contract terms to look at. It cannot tell you that a particular arrangement is compliant.

Where personal data is central to your business, or where you handle sensitive categories at scale, this is worth proper advice rather than a checklist, and the time to get it is while the deadline is still ahead of you.