What is a Data Processing Agreement (DPA) under the DPDP Act? A Data Processing Agreement (DPA) is a mandatory contract between a Data Fiduciary (the organisation that determines the purpose of processing) and a Data Processor (a third party that processes data on its behalf) under the DPDP Act 2023. The DPA must specify the categories of personal data to be processed, the permitted purposes, security obligations, breach notification requirements, sub-processor restrictions, and the obligation to return or destroy data at the end of the engagement. Operating without a DPA with data processors is a compliance violation.
DPDP Act requires written contracts with all vendors processing personal data on your behalf. Generate yours in minutes.
1.1 In this Agreement, "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under Section 2(t) of the Digital Personal Data Protection Act, 2023 ("DPDP Act").
1.2 "Data Fiduciary" means [your company], who alone or in conjunction with other persons determines the purpose and means of processing Personal Data, as defined under Section 2(i) of the DPDP Act.
1.3 "Data Processor" means [vendor name], who processes Personal Data on behalf of the Data Fiduciary, as defined under Section 2(k) of the DPDP Act.
1.4 "Processing" means an automated operation or set of operations performed on digital Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, or erasure.
1.5 "Data Principal" means the natural person to whom the Personal Data relates.
2.1 The Processor shall process Personal Data only for [nature of processing], as specified in Schedule A annexed hereto, and strictly in accordance with the documented instructions of the Fiduciary.
2.2 The Processor shall not process Personal Data for any purpose other than as instructed by the Fiduciary in writing, unless required to do so by applicable law.
2.3 The Processor shall inform the Fiduciary if, in its opinion, any instruction infringes the DPDP Act, 2023 or any other applicable data protection law, prior to carrying out such instruction.
The following categories of Personal Data are shared under this Agreement:
Section 8(2) of the Digital Personal Data Protection Act, 2023 places a clear obligation on every Data Fiduciary: if you engage a Data Processor — any vendor, contractor, or cloud provider that handles personal data on your behalf — you must have a written contract in place. This contract must require the Processor to implement reasonable security safeguards and comply with all applicable provisions of the DPDP Act.
In practice, this means that your payroll software vendor, HR management platform, CRM provider, cloud hosting company, IT support team, and background verification agency are all Data Processors if they touch personal data belonging to your employees or customers. Without a signed, DPDP-compliant DPA with each of these vendors, your organisation remains the sole party accountable for any data breach or misuse that occurs within the processor's systems.
The consequences are severe. Under Section 33 of the DPDP Act, penalties for failing to implement adequate safeguards — including failing to bind processors by contract — can reach ₹250 crore per incident. The Data Protection Board of India may investigate complaints filed by any Data Principal whose data was mishandled, even if the mishandling occurred at your vendor's infrastructure. Your DPA is your primary contractual defence in such proceedings.
A generic NDA or MSA does not satisfy the requirements of Section 8(2). The DPA must specifically address the nature of processing, categories of data, the processor's security obligations, breach notification timelines, sub-processor controls, and data return or deletion procedures — all within the framework of the DPDP Act, 2023.
A DPA that meets the requirements of the DPDP Act, 2023 must address several core obligations:
Note that copy-pasting a GDPR-compliant DPA is not sufficient. The DPDP Act has different definitions, thresholds, and requirements — particularly around "digital personal data" scope, the role of Data Principals, and the penalties structure.
These three agreements serve entirely different purposes and all three may be required in a vendor relationship:
In practice, the DPA is often executed as an addendum to the MSA, or incorporated by reference. However, it must exist as a distinct, identifiable document that can be produced during a regulatory audit or Board investigation.
