Vendor DPA Review Checklist: Audit Your Data Processing Agreements Under DPDP Rules 2025

Yes. Under the Digital Personal Data Protection Act 2023 and DPDP Rules 2025, every Data Fiduciary is required to have a legally binding contract with every Data Processor (vendor) that processes personal data on their behalf. The contract must cover the purpose of processing, security obligations, breach notification timelines (72 hours), sub-processor approval requirements, and data deletion or return obligations on termination. Operating without a compliant DPA is a direct violation of Section 8(2) of the DPDP Act and can attract penalties of up to ₹250 crore.

A DPDP-compliant Data Processing Agreement must include: (1) clear specification of the purpose and scope of processing; (2) restriction of processing to the Data Fiduciary's documented instructions; (3) obligation to assist with Data Principal rights requests — access, correction, erasure, and nomination; (4) 72-hour breach notification to the Data Fiduciary; (5) prohibition on engaging sub-processors without prior written consent; (6) data return or secure deletion procedures on contract termination; (7) technical and organisational security obligations aligned with DPDP Rules Schedule II; and (8) audit rights enabling the Data Fiduciary to verify compliance. A gap in any one of these clauses creates measurable legal exposure.

Under the DPDP Act 2023, the Data Fiduciary (your organisation) bears primary liability for all personal data it collects or is responsible for — even when a vendor causes the breach. Regulators can hold the Data Fiduciary accountable unless it can demonstrate that a compliant DPA was in place, the vendor was appropriately vetted, and reasonable security safeguards were mandated contractually. This makes a DPA audit an essential risk management step before the May 2027 enforcement date. The maximum penalty for a Significant Data Fiduciary is ₹250 crore per violation.