DPDP Compliance Is Due 13 May 2027. Is Your Vendor Contract Ready?

Why is DPDP a contract problem, not only a policy problem?

Organisations responding to DPDP tend to start with a privacy notice and a consent flow, which are visible and customer-facing. The harder work sits behind them, in the contracts with every vendor that touches personal data on your behalf: your CRM, your payroll provider, your support desk, your analytics tools, your cloud infrastructure.

Section 8(1) of the Digital Personal Data Protection Act, 2023 makes a data fiduciary responsible for complying with the Act in respect of processing undertaken by it or on its behalf by a data processor. Section 8(2) then says a data fiduciary may engage a data processor only under a valid contract. Read together, the contract is the instrument through which your obligations are passed down, and a contract that never mentions data protection roles is not doing that job.

The Act places most duties on the fiduciary rather than on the processor directly. So if your vendor mishandles data, the regulatory exposure lands first on you, and your only route to the vendor is whatever the contract says.

What is the DPDP timeline?

The Act was passed in August 2023 and the DPDP Rules, 2025 were notified on 13 November 2025. Rather than everything commencing at once, the Rules phase in. Provisions setting up the Data Protection Board took effect on notification. The rules on consent managers are scheduled to commence one year later, on 13 November 2026. Most of the substantive obligations, including notice, security safeguards, breach intimation and erasure, are scheduled to commence eighteen months after notification, on 13 May 2027.

In early 2026 the government proposed compressing the eighteen-month window. At the time of writing we have not seen an amendment notified, but this is exactly the kind of date that can move, so check the current notification before relying on it.

The practical reading for a business is that the deadline is close enough to matter for contracts being signed now. A three-year SaaS agreement signed in October 2026 runs to October 2029, straight through the compliance date. Getting the data protection terms right at signature is far cheaper than chasing an amendment later.

What the Act and Rules expect from the arrangement

• Reasonable security safeguards to prevent personal data breach, under Section 8(5), including processing by a processor.
• Intimation of a personal data breach to the Data Protection Board and to each affected data principal, under Section 8(6); the Rules require a detailed report to the Board within 72 hours of becoming aware, or longer if the Board allows.
• Erasure of personal data once consent is withdrawn or the purpose is no longer served, and causing the processor to erase it too, under Section 8(7).
• Retention of certain logs and related data for at least one year under the Rules, for the purpose of detecting and investigating breaches.
• Responding to data principal requests for access, correction and erasure, which a vendor holding the data must help you meet.
• Transfer outside India is permitted except to countries the government restricts by notification under Section 16, subject to stricter sectoral rules such as those of RBI.

What a vendor contract should address

Translated into contract terms, a vendor agreement or data processing addendum should cover the points below. The table pairs each term with the risk if it is missing and wording you can propose. Treat the wording as a starting point for your advocate, not a finished clause.

Why penalties make the contract terms matter

The Schedule to the Act sets maximum penalties that the Data Protection Board can impose, including up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to notify a breach. These are ceilings, and the Board must consider factors such as the nature, gravity and duration of the breach when deciding an amount.

Penalties fall on the fiduciary. Whether you can recover a penalty from a vendor whose failure caused it depends on the indemnity and liability clauses, and on whether a court would allow recovery of a regulatory penalty at all, which is not settled. What is clear is that a contract with a liability cap of one month's fees and no data breach carve-out gives you almost nothing to work with. Read the DPDP terms together with the liability clause.

It also helps to look at the liability clause from the other side. If you are a vendor to larger Indian businesses, expect your customers to ask for these same terms, along with a higher liability cap for data incidents. Having your own data processing addendum ready, aligned with the Act and the Rules, shortens sales cycles and avoids having to accept a customer's version drafted entirely in its favour.

The realistic remediation path

Auditing every vendor contract at once is not how this gets done in practice. The workable sequence is to inventory which vendors actually receive personal data, rank them by volume and sensitivity, and address the top of that list first. A payroll provider holding salary, bank and PAN details for 400 employees is not the same risk as a design tool holding five email addresses.

For contracts up for renewal, the renewal is the moment of leverage. For long-dated contracts, most enterprise vendors are issuing data processing addenda proactively because their other customers are asking, so requesting one is usually a short conversation rather than a negotiation. Smaller Indian vendors may not have one ready, in which case offering your own short addendum is often quicker than waiting.

A worked example: a 60-person consumer brand

Take a direct-to-consumer brand with 60 staff and 2 lakh customers. Its personal data sits with perhaps twelve vendors: an e-commerce platform, a payment gateway, a logistics aggregator, a CRM and email tool, a customer support desk, an analytics tool, a payroll provider, an HR system, a cloud host, a marketing agency, a call centre and a feedback survey tool.

Ranked by risk, the e-commerce platform, CRM, support desk and call centre hold the full customer database with addresses and phone numbers. The payroll provider and HR system hold bank details, PAN and Aadhaar-linked records for staff. These six go first. The survey tool and analytics tool come next, mainly to confirm they are not using customer data for their own purposes. The payment gateway is already regulated by RBI and usually has a mature data addendum, so the work there is a check, not a negotiation.

In practice the brand finds that four of the six high-risk contracts say nothing about breach notification timelines, two allow the vendor to use data to improve its services without limit, and the call centre contract has no deletion clause at all. Those three gaps, breach notice, purpose limitation and deletion, are where most Indian vendor contracts fall short, and fixing them in six contracts is a manageable piece of work.

A step-by-step plan for the next six months

• List every vendor and tool that receives personal data, including free tools used by teams on their own.
• Record for each: what data, whose data, where it is stored, and the contract renewal date.
• Rank by sensitivity and volume: financial, health, children's data and large customer databases first.
• Request the vendor's data processing addendum and sub-processor list; compare against the table above.
• Negotiate gaps at renewal, or by a short amendment for high-risk vendors whose contracts run past May 2027.
• Update your own breach response plan so vendor notifications feed into the 72-hour report to the Board.
• Diary a check of the commencement dates, since the timeline may change.

A caution on precision

This is a regime that is still bedding in. The Rules were notified recently, the phasing is spread over time, the dates may be revised, and the Board's practice has yet to develop. A guide can tell you the shape of the obligations and which contract terms to look at. It cannot tell you that a particular arrangement is compliant.

Where personal data is central to your business, where you process children's data, or where you handle sensitive categories at scale, this is worth proper advice from an advocate rather than a checklist, and the time to get it is while the deadline is still ahead of you.