Data Processing Agreement Under the DPDP Act, 2023: Key Clauses Explained

Introduction

Businesses increasingly rely on third-party vendors, cloud service providers, technology platforms and outsourced service providers to process personal data. These arrangements may involve customer information, employee records, transaction data or other digital personal data. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), engaging an external service provider to process personal data does not relieve the business of its statutory responsibilities.

Section 8(2) of the DPDP Act permits a Data Fiduciary to engage a Data Processor to process personal data on its behalf for activities related to offering goods or services to Data Principals only under a valid contract. Section 8(1) further provides that the Data Fiduciary remains responsible for compliance with the Act and the rules made under it in respect of processing undertaken either directly or on its behalf by a Data Processor.

Although the Act requires a valid contract, it does not prescribe a comprehensive, clause-by-clause template for a data processing agreement (DPA). This leaves businesses to determine how their contracts should allocate operational responsibilities, establish security requirements, regulate subcontracting and facilitate compliance with applicable legal obligations.

A carefully drafted DPA can help bridge this gap. It can establish the permitted purposes of processing, specify security safeguards, regulate the use of sub-processors, provide for incident reporting and establish procedures for returning or deleting personal data. These contractual protections are particularly important because the Data Fiduciary remains responsible for its statutory obligations even when a third party performs the processing.

The DPDP Act and the Digital Personal Data Protection Rules, 2025 provide the legal framework for these arrangements, with substantive obligations commencing in phases. This article examines the key clauses businesses should consider when drafting a data processing agreement under Indian law, distinguishing express statutory requirements from contractual safeguards that may be adopted to manage operational and compliance risks.

Scope of Processing, Purpose Limitation and Documented Instructions

A data processing agreement should begin by defining precisely what the Data Processor is authorised to do. A broad clause permitting a vendor to process personal data for any purpose connected with the services may create uncertainty about the scope of the engagement and make compliance more difficult to demonstrate.

The agreement should identify the categories of personal data involved, the categories of Data Principals concerned, the services being provided, the purposes of processing, the duration of processing and the permitted processing operations. It should also specify the systems or environments in which the data may be accessed and any relevant restrictions on its use.

These provisions should reflect the underlying arrangement between the parties. For example, a payroll service provider may need access to employee identification and salary information to administer payroll, but that access should not automatically authorise it to use the information for unrelated analytics, marketing or product development.

Section 8(2) requires the Data Fiduciary to engage a Data Processor under a valid contract for the activities specified in that provision. Purpose limitation also needs to be considered in the context of the Act’s wider requirements governing lawful processing and specified purposes. The contract should therefore identify the instructions under which the processor is expected to operate and establish a mechanism for updating them when the services change.

The agreement should address what happens if the processor receives an instruction that falls outside the agreed scope or appears inconsistent with applicable law. A requirement to notify the Data Fiduciary and seek clarification before undertaking the disputed activity can help prevent unauthorised processing.

A clear scope clause also provides a reference point for the remaining provisions of the agreement. Security controls, retention periods, sub-processing permissions and deletion obligations can all be tailored to the actual processing activities rather than expressed as generic commitments.

Data Security and Technical and Organisational Measures

Security provisions are central to a data processing agreement because the Data Fiduciary remains responsible for protecting personal data processed on its behalf.

Section 8(4) of the DPDP Act requires a Data Fiduciary to implement appropriate technical and organisational measures to ensure effective observance of the Act and the rules made under it. Section 8(5) requires the Data Fiduciary to protect personal data in its possession or under its control, including data processed on its behalf by a Data Processor, through reasonable security safeguards to prevent personal data breaches.

The agreement should translate these obligations into specific, verifiable commitments appropriate to the nature of the processing and the risks involved. A generic promise to maintain adequate security may be difficult to assess or enforce if the parties have not agreed on what the commitment requires in practice.

Depending on the services involved, the agreement may address encryption, access controls, authentication requirements, network security, logging and monitoring, vulnerability management, security testing, backup arrangements and incident response procedures. It should also establish confidentiality obligations for personnel authorised to access personal data and require appropriate training and access restrictions.

The parties should consider whether the processor must provide evidence of its security measures, notify the Data Fiduciary of material security deficiencies and remediate identified vulnerabilities within agreed timelines. Where the processing involves sensitive business operations or substantial volumes of personal data, more detailed technical schedules may be appropriate.

The agreement should also address changes to the processor’s systems or security arrangements that could materially affect the processing. This is particularly relevant where the vendor relies on cloud infrastructure, third-party hosting or outsourced technical support.

The precise safeguards should be proportionate to the engagement. The objective is not simply to include an extensive security checklist, but to establish enforceable commitments that allow the Data Fiduciary to assess whether the processor’s practices are consistent with the applicable legal requirements.

Sub-Processing and the Use of Third-Party Service Providers

A Data Processor may rely on other service providers to perform parts of its contractual obligations. For example, a software provider may use an external cloud-hosting service, while an outsourced customer-support provider may rely on a separate platform for ticket management. A data processing agreement should address whether the processor may engage such sub-processors, the circumstances in which it may do so and the obligations that must apply to them.

The DPDP Act does not set out a comprehensive statutory approval procedure for sub-processing. Consequently, the parties should establish an appropriate contractual mechanism rather than assume that the processor can freely appoint third parties without oversight.

Depending on the arrangement, the agreement may require prior written authorisation for each sub-processor or permit general authorisation subject to advance notice of proposed changes and a defined objection process. The appropriate model will depend on the nature of the services, the degree of control required and the parties’ operational requirements.

The contract should also require the processor to ensure that sub-processors are subject to appropriate confidentiality, security, purpose limitation, incident reporting and deletion obligations. These obligations should be consistent with the commitments the primary processor has undertaken to the Data Fiduciary.

The agreement should clarify that appointing a sub-processor does not, by itself, release the primary processor from its contractual responsibilities. It should also specify what happens if a sub-processor fails to comply with the agreed requirements, including the circumstances in which the Data Fiduciary may require corrective action or the cessation of the relevant processing. A well-designed sub-processing clause helps the Data Fiduciary understand where its data is being processed, which parties may access it and how contractual protections extend throughout the service chain.

Audit Rights, Compliance Evidence and Regulatory Cooperation

A contractual commitment to comply with security and data protection requirements is more useful when the Data Fiduciary can obtain reasonable evidence that the commitment is being honoured. The DPDP Act does not establish a general, express statutory right for every Data Fiduciary to conduct on-site audits of its processors. An agreement should therefore address the extent to which the processor must provide compliance information, cooperate with assessments and permit audits.

An audit clause may allow the Data Fiduciary to review relevant policies, security documentation, certifications, assessment reports and other evidence reasonably necessary to evaluate the processor’s compliance. Where appropriate, it may also provide for an independent auditor to conduct an assessment.

The clause should establish practical parameters, including reasonable notice, audit frequency, confidentiality, the protection of other customers’ information, access to relevant records and the allocation of audit costs. Separate arrangements may be necessary where an incident, material security concern or regulatory inquiry requires more immediate access.

The agreement should also address cooperation with lawful requests from competent authorities, including the Data Protection Board of India where applicable. This may involve preserving relevant records, providing information about the processing, assisting with investigations and implementing required remedial measures.

Audit rights should be drafted to match the actual relationship. A small vendor providing a limited service may be assessed through documentation and independent reports, while a critical technology provider handling substantial volumes of personal data may require more extensive assurance mechanisms. The purpose is to give the Data Fiduciary a practical means of assessing compliance and identifying deficiencies before they result in a breach or regulatory problem.

Personal Data Breach Notification and Incident Response

A data processing agreement should establish a clear procedure for notifying the Data Fiduciary of a personal data breach or a suspected incident that may affect the data being processed. Section 8(6) of the DPDP Act requires the Data Fiduciary to notify the Board and each affected Data Principal of a personal data breach in the prescribed form and manner. Rule 7 of the Digital Personal Data Protection Rules, 2025 sets out the relevant notification framework, including intimation without delay and a detailed intimation to the Board within seventy-two hours, subject to the rule’s provisions.

The substantive provisions governing these obligations are scheduled to commence eighteen months after 13 November 2025, under the phased commencement notifications. Accordingly, the seventy-two-hour reporting requirement should be described as part of the notified framework that is scheduled to apply when the relevant provisions commence, rather than as an obligation already in force in October 2026.

A Data Fiduciary cannot effectively meet a short regulatory reporting timeline if a processor delays notifying it of an incident. The agreement should therefore establish an internal notification deadline that gives the Data Fiduciary sufficient time to assess the incident, determine its reporting obligations and prepare the required communications.

For example, the parties may agree that the processor must notify the Data Fiduciary within twenty-four hours of becoming aware of a suspected or confirmed incident involving the relevant personal data. This is a contractual safeguard, not a universal statutory notification deadline imposed on every processor by the DPDP Act.

The agreement should specify the information the processor must provide, including the nature and timing of the incident, the systems and data affected, the categories or approximate number of affected individuals where ascertainable, the likely consequences, containment measures and the steps being taken to investigate and remediate the incident.

It should also require the processor to provide supplementary information as it becomes available, preserve relevant evidence, cooperate with investigations and avoid making external statements about the incident on the Data Fiduciary’s behalf without appropriate authorisation, subject to applicable legal requirements.

The parties should agree on escalation contacts, out-of-hours reporting channels and procedures for coordinating communications. These provisions can materially improve the Data Fiduciary’s ability to respond quickly and meet applicable legal obligations.

Data Retention, Deletion and Return of Personal Data

Data retention and deletion provisions require particular attention because the Data Fiduciary’s compliance may depend on actions performed within systems controlled by an external processor.

Section 8(7) of the DPDP Act requires the Data Fiduciary, unless retention is necessary for compliance with another law, to erase personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, whichever occurs earlier. The provision also requires the Data Fiduciary to cause its processor to erase personal data made available to it for processing.

The agreement should establish how these obligations will be implemented operationally. It should identify the events that trigger deletion, the applicable timelines, the process for issuing deletion instructions and the circumstances in which data must be retained to comply with another legal requirement.

Rule 8 of the DPDP Rules, 2025 addresses the period after which a specified purpose is deemed no longer to be served for prescribed classes of Data Fiduciaries and purposes. It should not be treated as a universal deletion procedure applicable in the same way to every business or processing activity. The relevant statutory and rule-based requirements must be assessed for the particular engagement.

The contract should distinguish between deletion during the ongoing relationship and deletion following termination of the services. It should also address the return of data where the Data Fiduciary requires it to be transferred to a replacement service provider or brought back into its own systems.

Where data must be returned, the agreement should specify the format, transfer method, applicable deadline and responsibilities for ensuring that the transfer is completed securely. It should then establish when the processor must delete its remaining copies, subject to any lawful retention requirement.

Deletion provisions should also consider backups, archives, disaster-recovery systems and copies held by authorised sub-processors. Because deletion from backup systems may not be technically immediate, the contract should establish a realistic and documented process for ensuring that retained copies are appropriately isolated and deleted in accordance with the agreed schedule.

A written deletion confirmation or certificate may be useful evidence of completion. The agreement should specify who provides it, what it covers and how exceptions are documented. Where retention is legally required, the processor should identify the basis for retention, restrict further use as appropriate and delete the data when the retention requirement no longer applies.

These provisions help turn the Data Fiduciary’s statutory deletion responsibility into a defined process that can be monitored and evidenced.

Confidentiality, Personnel Access and Assistance with Data Principal Requests

A DPA should address the confidentiality of personal data and the conditions under which the processor’s personnel may access it. The agreement may require the processor to ensure that individuals authorised to process personal data are subject to appropriate confidentiality obligations and can access the data only to the extent necessary to perform their assigned functions. It may also establish requirements for staff training, access revocation when personnel leave or change roles, and the management of privileged access.

The agreement should further address assistance with requests or communications from Data Principals. Depending on the services involved, the processor may need to help the Data Fiduciary locate, correct, retrieve, restrict or erase relevant data, or provide information required to respond to a request.

The processor’s role should be clearly defined. The Data Fiduciary should retain responsibility for determining how to respond to a request and for ensuring compliance with applicable legal requirements, while the processor should provide the assistance reasonably required under the contract.

The parties should also establish procedures for forwarding requests received directly by the processor, responding within agreed internal timelines and maintaining records of the assistance provided. These provisions are particularly relevant where personal data is distributed across multiple systems or where a vendor operates the principal platform through which the Data Fiduciary interacts with individuals.

Contract Termination, Liability and Allocation of Risk

A data processing agreement should specify what happens when the underlying services end, the processor breaches its obligations or the parties can no longer continue the arrangement.

The agreement should identify the circumstances in which the Data Fiduciary may suspend processing, require corrective action or terminate the arrangement. These may include material security failures, unauthorised sub-processing, repeated non-compliance with contractual instructions or failure to comply with agreed incident reporting and deletion requirements.

The contract should also address responsibility for losses arising from a breach of its terms. Indemnities, liability caps, exclusions and insurance requirements may be relevant, depending on the commercial arrangement and the parties’ bargaining positions.

However, contractual allocation of risk does not displace the Data Fiduciary’s statutory responsibility under Section 8(1) of the DPDP Act. An agreement cannot, merely by assigning responsibility to the processor, eliminate the Data Fiduciary’s obligations to comply with the Act and the applicable rules. The parties should therefore distinguish between statutory accountability and contractual recourse. The Data Fiduciary remains responsible for its compliance obligations, while the agreement may provide remedies against a processor that fails to perform its contractual commitments.

The termination provisions should also coordinate with the data return and deletion clause, ensuring that processing does not continue indefinitely after the services have ended and that any legally required retention is properly documented.

Conclusion

A data processing agreement under the DPDP Act, 2023 is an important part of managing the legal and operational risks associated with outsourcing personal data processing. Section 8(2) requires a valid contract for engaging a Data Processor in the circumstances specified by the provision, while Section 8(1) makes clear that the Data Fiduciary remains responsible for compliance with the Act and its rules in respect of processing undertaken on its behalf.

Although Indian law does not prescribe a comprehensive statutory DPA template, businesses can use their contracts to establish clear processing instructions, proportionate security safeguards, controlled sub-processing, compliance assurance, incident notification procedures and precise data retention, return and deletion obligations.

The effectiveness of these provisions depends on how closely they reflect the actual processing arrangement and how clearly responsibilities, timelines and evidence requirements are defined. A generic vendor agreement may not adequately address the practical steps required to manage personal data throughout the service relationship.

With the DPDP Act’s substantive obligations scheduled to commence in phases, businesses should review their existing vendor contracts and identify provisions that may need to be updated before the relevant requirements take effect. A well-structured data processing agreement cannot transfer away the Data Fiduciary’s statutory accountability, but it can establish the contractual controls needed to manage third-party processing more effectively and support compliance with India’s evolving data protection framework.