What is a third-party (vendor) risk register under DPDP? A third-party risk register is a structured record of every vendor that processes personal data on your behalf, rated by the sensitivity and volume of data they handle. Under Section 8(2) of the DPDP Act 2023, a Data Fiduciary is accountable for its processors, so it must know who they are, tier them by risk, ensure each has a signed data processing agreement, and reassess them periodically. This tool builds that register and a tiering report for your organisation.
Know your processor risk. Tier every vendor by data sensitivity, track DPA coverage, and get a prioritised remediation plan — the core of DPDP vendor governance.
1.1 Each vendor row records: vendor name, service, data categories shared, data location, criticality, DPA status, last review date and risk tier. This is the single source of truth a Data Protection Board investigator would expect you to produce.
1.2 The register is designed to be maintained by a non-specialist and reviewed quarterly, so it stays current rather than becoming a one-off spreadsheet.
2.1 Vendors are scored on data sensitivity, data volume, processing criticality and access level, then placed into Tier 1 (critical), Tier 2 (important) or Tier 3 (low) — focusing your effort where the exposure is greatest.
2.2 Each tier carries a defined control expectation: Tier 1 vendors need full DPAs, security review and annual reassessment; Tier 3 need a lighter touch. The methodology is fully explained so you can defend your ratings.
Based on your selections, the full report tiers and tracks these vendor categories:
Section 8(2) of the DPDP Act 2023 makes the Data Fiduciary accountable for the personal data it shares with processors. If your cloud host, payroll provider or marketing platform suffers a breach, the regulator looks to you. You cannot outsource accountability.
Most organisations have dozens of vendors touching personal data and no consolidated view of them. A risk register and tiering exercise turns that blind spot into a managed, defensible programme — and is usually the first thing an auditor or enterprise client asks to see.
Treating every vendor the same wastes effort and misses the real risks. Tiering concentrates DPAs, security reviews and reassessment on the vendors that handle the most sensitive data.
This report gives you not just a register but the methodology, remediation plan and calendar that turn it into an ongoing programme. For hands-on vendor remediation or DPA drafting at scale, NitiBharat offers fixed-fee support.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
