Data Processing Addendum (DPDP)
An addendum allocating data fiduciary and processor roles, for vendor contracts signed before the DPDP Rules were notified.
A data processing addendum is a short contract attached to a vendor agreement that sets out how the vendor handles personal data on your behalf. The DPDP Act, 2023 allows a Data Fiduciary to use a Data Processor only under a valid contract.
What to watch when you use this
- Most vendor contracts in force were signed before the DPDP Rules were notified in November 2025 and do not allocate roles at all.
- Obligations phase in, with fuller compliance expected from 13 May 2027.
- Roles are allocated by category of data rather than by a single blanket statement, since one vendor is often both.
- This addendum is a starting point; where you process sensitive data at scale, take advice rather than adopting a form.
Stamping and registration. Stamp duty is a State subject, and an unstamped or insufficiently stamped instrument is generally inadmissible in evidence under Section 35 of the Indian Stamp Act, 1899 until the duty and penalty are paid. Registration requirements are separate and depend on the instrument and the State. Confirm both for your State before executing this document.
DATA PROCESSING ADDENDUM
This Addendum is made on [DATE] between [CUSTOMER NAME], [ADDRESS] ("Customer") and [VENDOR NAME], [ADDRESS] ("Vendor"), and forms part of the agreement between them dated [DATE] ("Principal Agreement").
1. DEFINITIONS
Terms used in this Addendum that are defined in the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP") have the meanings given there.
2. ROLES
2.1 In respect of the personal data described in Annexure A, the Customer is the Data Fiduciary and the Vendor is a Data Processor acting on the Customer's behalf.
2.2 In respect of the data described in Annexure B, which the Vendor processes for its own purposes, the Vendor acts as a Data Fiduciary in its own right.
2.3 The parties will review Annexures A and B if the processing changes.
3. PROCESSING ON INSTRUCTIONS
The Vendor will process personal data described in Annexure A only on the Customer's documented instructions and only for the purposes set out there, and will not process it for its own purposes, including the development, improvement or training of any product, service or model, without the Customer's prior written consent.
4. SECURITY
The Vendor will implement and maintain reasonable security safeguards appropriate to the nature of the personal data and the processing, and will restrict access to personnel who need it to perform the Principal Agreement.
5. PERSONAL DATA BREACH
The Vendor will notify the Customer without undue delay, and in any event within [NUMBER] hours, of becoming aware of a personal data breach affecting the personal data described in Annexure A, and will provide the information reasonably required for the Customer to meet its own obligations.
6. SUB-PROCESSING
6.1 The Vendor may engage sub-processors listed in Annexure C.
6.2 The Vendor will give the Customer [NUMBER] days' written notice before adding or replacing a sub-processor, and the Customer may object on reasonable grounds.
6.3 The Vendor will impose on each sub-processor obligations no less protective than those in this Addendum, and remains responsible for their performance.
7. ASSISTANCE
The Vendor will provide reasonable assistance to enable the Customer to respond to requests from Data Principals and to meet its obligations under DPDP, within [NUMBER] days of a written request.
8. CROSS-BORDER PROCESSING
The Vendor will process personal data in the locations listed in Annexure D and will notify the Customer before processing in any other location.
9. DELETION AND RETURN
On termination of the Principal Agreement, the Vendor will, at the Customer's election, return or delete the personal data described in Annexure A within [NUMBER] days, other than copies it is required by law to retain, and will confirm in writing that it has done so.
10. RECORDS AND AUDIT
The Vendor will maintain records of its processing and, on reasonable written notice and no more than [ONCE] per year, provide the Customer with the information reasonably necessary to demonstrate compliance with this Addendum.
11. PRECEDENCE
In the event of conflict between this Addendum and the Principal Agreement in relation to the processing of personal data, this Addendum prevails.
Signed:
_______________________ _______________________
For [CUSTOMER] For [VENDOR]
ANNEXURE A: PERSONAL DATA PROCESSED ON THE CUSTOMER'S BEHALF
[Categories of data, categories of data principals, nature and purpose of processing, duration.]
ANNEXURE B: DATA THE VENDOR PROCESSES FOR ITS OWN PURPOSES
ANNEXURE C: APPROVED SUB-PROCESSORS
ANNEXURE D: PROCESSING LOCATIONS
---
This free template is provided by ClauseAudit as general information, not legal advice, and using it does not create an advocate-client relationship. Replace every [BRACKETED] placeholder. Stamp duty and registration requirements vary by State and are your responsibility. Have the final document reviewed by a qualified advocate before use.When to use this template
- When a vendor, such as a cloud, payroll, CRM, support or analytics provider, processes personal data of your customers or employees.
- When your existing vendor contract was signed before the DPDP Rules were notified in November 2025 and says nothing about data roles.
- When a vendor's standard terms allow it to use your data to improve or train its products and you want to limit that.
- When preparing for the DPDP compliance obligations that phase in through 2026 and 2027.
How to fill it in
- Identify the Principal Agreement by its date and parties. The addendum forms part of it.
- Complete Annexure A: categories of personal data, categories of Data Principals, nature and purpose of processing, and duration.
- Complete Annexure B for data the vendor uses for its own purposes, such as account and billing contacts. Keep it short, because anything listed here falls outside your instructions.
- Ask the vendor for its current sub-processor list and processing locations, and fill in Annexures C and D.
- Fill in the breach notification window in clause 5. A short window, such as 24 to 48 hours, leaves you time to meet your own reporting duties.
- Fill in the notice periods for sub-processor changes, assistance requests, deletion and the audit frequency.
- Have authorised signatories of both parties sign. Stamp duty may apply as an agreement under your State's stamp law, so check with your advocate.
Key clauses explained
- Roles (clause 2)
- Allocates roles by category of data: the customer is the Data Fiduciary for Annexure A data, while the vendor is a Fiduciary for its own data in Annexure B. One vendor is often both.
- Processing on instructions (clause 3)
- The vendor may process Annexure A data only on documented instructions, and may not use it to develop, improve or train any product, service or model without prior written consent.
- Personal data breach (clause 5)
- Requires notice within a fixed number of hours plus the information you need. Your own duty to inform the Data Protection Board and affected Data Principals depends on hearing quickly.
- Sub-processing (clause 6)
- Lists approved sub-processors, requires notice before changes with a right to object, and keeps the vendor responsible for its sub-processors.
- Cross-border processing (clause 8)
- The vendor must process only in listed locations and tell you before using any other. This lets you track transfers against any restrictions notified under the DPDP Act.
- Deletion and return (clause 9)
- On termination, data must be returned or deleted within a set period and deletion confirmed in writing, which supports your own erasure duties as Data Fiduciary.
Frequently asked questions
Is a data processing addendum mandatory under the DPDP Act?
The Act does not prescribe a document called a DPA. But Section 8 of the Digital Personal Data Protection Act, 2023 allows a Data Fiduciary to engage a Data Processor only under a valid contract, and keeps the Fiduciary responsible for compliance. An addendum like this is the practical way to meet that requirement where the main contract does not already deal with it.
When do the DPDP obligations apply?
The DPDP Rules were notified in November 2025 with a phased start. Provisions on the Data Protection Board applied first, the consent manager provisions follow about a year later, and most substantive obligations, including breach reporting, are scheduled for 13 May 2027. The government has proposed shortening this timetable, so check the current position before relying on these dates.
Who is liable if the vendor causes a data breach?
Under the Act, the Data Fiduciary remains responsible for personal data processed on its behalf, so the regulator will look to you first. The Schedule to the Act provides penalties of up to ₹250 crore for failure to take reasonable security safeguards. This addendum does not shift that regulatory liability, so also review indemnity and liability caps in the Principal Agreement.
What has to happen after a breach?
Once these provisions take effect, the DPDP Rules require the Data Fiduciary to inform affected Data Principals and the Data Protection Board of India of a personal data breach, with a detailed report to the Board within 72 hours of becoming aware of it. You can only manage that if the vendor tells you quickly, which is why clause 5 sets a specific deadline in hours.
Can the vendor use our data to train its own models?
Not under this addendum without your prior written consent. Clause 3 bars processing of Annexure A data for the vendor's own purposes, including development, improvement or training of any product, service or model. Many standard vendor terms reserve such rights, so read the Principal Agreement and any linked policies, and make sure this addendum prevails, as clause 11 provides.
Can personal data be stored outside India?
Generally yes. Section 16 of the DPDP Act lets the Central Government restrict transfers to countries it notifies, rather than requiring localisation by default. Sector regulators can impose stricter rules, for example on payment data. Clause 8 and Annexure D tell you where your data is processed and require notice before it moves anywhere else.
Been handed the other side's version instead?
Upload it and get every clause checked against Indian law, with the provision each finding rests on.
Run the DPDP Compliance CheckRead before you sign
- DPDP Compliance Is Due 13 May 2027. Is Your Vendor Contract Ready?The DPDP Rules were notified in November 2025 and phase in to May 2027. Here is what that means for the contracts you have already signed.
- Data Fiduciary or Data Processor? Getting DPDP Roles Right in Your ContractsThe DPDP Act distinguishes who decides how data is used from who processes it on their behalf. Getting the roles wrong misallocates the obligations.
- DPDP Compliance Checklist for Indian Businesses: What to Do Before November 2026, Before May 2027 and AfterA dated DPDP compliance checklist for Indian businesses: notice, consent, Rule 6 security, breach, erasure, rights, children, vendors and cross-border.
- DPDP Act Penalties Explained: Every Line of the Schedule, How the Board Sets the Amount, and Who PaysDPDP Act penalties run up to ₹250 crore. See every Schedule line, the section 33 factors, the Board’s inquiry, appeals and who pays when a vendor leaks data.
This free template is general information about Indian law as at 2026-10-10, not legal advice, and using it does not create an advocate–client relationship. Replace every bracketed placeholder and have the final document reviewed by a qualified advocate before use.