How Should Companies Handle Data Shared with Vendors Under the DPDP Act?

India’s Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025 notified in November 2025, has reshaped how organisations manage personal data. A core principle is that the Data Fiduciary remains fully accountable even when personal data is shared with or processed by vendors and other third parties. Substantive obligations largely take effect from mid-May 2027, with Consent Manager provisions activating around November 2026. Companies that treat the intervening period as a preparation window can avoid significant penalties (up to ₹250 crore for failures in security safeguards) and build stronger vendor governance.

This article explains practical steps for handling data shared with vendors, focusing on contracts, security, breach response, cross-border issues, and ongoing oversight. It draws on the current phased timeline and statutory requirements so organisations can prioritise actions now.

Understanding Roles: Data Fiduciary vs Data Processor

Under the DPDP Act, a Data Fiduciary determines the purpose and means of processing personal data. A Data Processor processes that data on behalf of the Fiduciary. Vendors such as cloud providers, payroll processors, analytics tools, KYC services, customer-support platforms, and marketing agencies typically act as Data Processors when they handle personal data under the company’s instructions.

Section 8 of the Act makes clear that the Fiduciary’s obligations continue irrespective of any agreement to the contrary. The Fiduciary must ensure that processing by a Processor occurs only under a valid contract. Security safeguards required of the Fiduciary also extend to processing undertaken on its behalf. In practice this means liability for vendor failures largely stays with the company that engaged the vendor.

Core Contractual Requirements for Vendor Engagements

The Act does not prescribe a rigid template, yet Section 8(2) requires a valid contract. Effective data processing agreements (DPAs) or addenda should address the following elements drawn from the Act and Rules:

• Clear purpose limitation and permitted processing activities, including categories of personal data.
• Instructions that the Processor may act only on documented directions from the Fiduciary and must not determine purpose or means independently.
• Technical and organisational security measures that meet the “reasonable security safeguards” standard.
• Restrictions on sub-processing: the Processor cannot appoint further sub-processors without prior authorisation and must flow down equivalent obligations.
• Assistance with Data Principal rights requests (access, correction, erasure, withdrawal of consent).
• Prompt breach notification to the Fiduciary (contracts commonly require 24–48 hours so the Fiduciary can meet its own reporting duties).
• Data retention, return, and erasure obligations aligned with Section 8(7): personal data must be erased once the purpose is no longer served and retention is not required by law.
• Audit and inspection rights for the Fiduciary or an independent auditor.
• Indemnity and liability allocation that recognise the Fiduciary’s primary regulatory exposure.
• Cross-border transfer provisions consistent with Section 16 and Rule 15.

Companies should inventory all vendors that process personal data of individuals in India (customers, employees, candidates, or other contacts) and prioritise high-volume or high-sensitivity relationships for contract remediation during 2026.

Security Safeguards and Ongoing Oversight

Rule 6 and related provisions require reasonable security safeguards covering confidentiality, integrity, and availability. These apply to data processed by vendors. Practical steps include:

• Conducting due diligence before onboarding (security questionnaires, certifications, past incident history).
• Requiring encryption, access controls, logging, and regular vulnerability management in the contract.
• Retaining records of processing activities and related logs for at least one year where applicable under the Rules.
• Periodic audits or independent assessments, especially for Significant Data Fiduciaries once designated.
• Mapping data flows so the organisation knows exactly what personal data leaves its systems and where it resides.

Significant Data Fiduciaries face additional duties (India-based Data Protection Officer, periodic Data Protection Impact Assessments, and independent audits). Even organisations not yet designated should prepare for possible future notification based on volume, sensitivity, and risk factors.

Breach Notification and Incident Response

The Fiduciary must intimate a personal data breach to the Data Protection Board and affected Data Principals. The Rules introduce a structured process (immediate intimation followed by a detailed report within 72 hours in many interpretations of the framework). Because the clock starts when the Fiduciary becomes aware, contracts must compel vendors to notify the company quickly and with sufficient detail. Organisations should maintain an internal breach runbook that includes vendor escalation paths and tested communication templates.

Cross-Border Transfers Involving Vendors

Section 16 adopts a negative-list approach: personal data may be transferred outside India unless the Central Government restricts a specific country or territory. As of mid-2026 no restricted list had been notified, so transfers remain generally permissible subject to any future government requirements under Rule 15. Vendor contracts should still address:

• Location of processing and storage.
• Conditions under which data may be made available to foreign states or entities under their control.
• Security and confidentiality commitments that survive transfer.
• Return or deletion of data upon contract termination.

Companies with overseas affiliates or global cloud providers should document these flows and monitor MeitY notifications closely.

Practical Comparison: Key Vendor Obligations Under DPDP vs Typical Legacy Contracts

This table highlights the shift from commercial risk allocation to regulatory accountability. Updating contracts is one of the highest-priority actions for 2026.

Step-by-Step Action Plan for Companies

• Complete a data-mapping exercise that identifies every vendor processing personal data linked to India.
• Classify each relationship (Processor vs joint Fiduciary) and assess risk based on data volume and sensitivity.
• Draft or update DPAs incorporating the clauses listed earlier; negotiate priority agreements first.
• Embed security and breach-notification requirements into procurement and vendor-management processes.
• Train procurement, legal, IT, and business teams on the Fiduciary’s continuing responsibility.
• Establish monitoring: periodic compliance attestations, audit schedules, and incident drills involving key vendors.
• Prepare for Consent Manager registration (from November 2026) if the organisation plans to use such platforms, and for full substantive enforcement from May 2027.
• Document everything. Evidence of contracts, diligence, and oversight will be critical if the Data Protection Board inquires.

Looking Ahead

As of September 2026 the Data Protection Board’s full operational staffing continues to evolve, yet the statutory framework and Rules are already published. Organisations that treat vendor data sharing as a core compliance workstream rather than a secondary commercial issue will be better positioned when enforcement begins. The emphasis on Fiduciary accountability means weak vendor controls can translate directly into regulatory exposure for the company itself.

For the official text of the framework, refer to the Digital Personal Data Protection Rules, 2025 published by the Ministry of Electronics and Information Technology. The enforcement timeline notification issued alongside the Rules provides the precise phased commencement dates that every compliance programme should track.

By embedding robust contractual controls, continuous oversight, and clear incident pathways, companies can share data with vendors while meeting their obligations under India’s evolving data protection regime.

Frequently Asked Questions