DPDP Vendor DPA Checklist

Quick Answer

Under DPDP Act 2023, Data Fiduciaries must ensure that their Data Processors (vendors) are bound by a contract containing specific obligations. A vendor that processes personal data without a DPDP-compliant Data Processing Agreement (DPA) creates direct liability exposure for you as the Fiduciary.

DPDP Compliance Checker

Does the contract limit the vendor to processing data only for specified purposes?

Does the contract require specific security safeguards?

Does the contract require the vendor to notify you of breaches?

Does the contract give you audit rights over the vendor?

Does the contract require prior approval for sub-processors?

Does the contract require data deletion at contract end?

Get the Full Compliance Guide (Free)

Frequently Asked Questions

Is a Data Processing Agreement mandatory under DPDP Act 2023?+

Yes. Under DPDP Section 8, a Data Fiduciary engaging a Data Processor must ensure the processing is done under a valid contract. The contract must impose the Processor obligations under Section 8 on the vendor. Processing personal data without a DPA exposes the Fiduciary to enforcement risk.

What is the key DPA clause for breach notification under DPDP?+

The DPA must require the vendor (Processor) to notify the Fiduciary of any breach within 24 hours of discovery — so the Fiduciary can meet their own 72-hour DPB notification obligation under Section 8(6).

Can I use a GDPR-standard DPA for DPDP compliance?+

A GDPR-standard DPA covers many of the same requirements but uses EU-specific terminology and legal bases that do not align with DPDP. Use a DPDP-specific DPA template or add a DPDP addendum to existing GDPR DPAs for vendors who also serve EU customers.

Related DPDP Tools

Vendor DPA Review Pack Vendor Risk Scorecard Third-Party Risk Register SaaS DPDP Pack

Every Sunday

The Sunday DPDP Brief

One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.

No spam. Unsubscribe with one click, anytime.