The Indian Data Processing Agreement: Clause-by-Clause Under the DPDP Act and Rules, With Wording
From 13 May 2027 a Data Fiduciary may engage a processor only under a valid contract with security provisions. What an Indian data processing agreement must contain under the DPDP Act and Rules, clause by clause, with wording, and how to roll it out across vendors before the deadline.
Indian companies have signed GDPR-style data processing addenda for years because European customers asked for them. From 13 May 2027 the obligation is domestic: sections 3 to 17 of the Digital Personal Data Protection Act, 2023 and the operative rules of the DPDP Rules, 2025 commence, and a Data Fiduciary may engage a Data Processor "only under a valid contract" with security provisions. This guide sets out what that contract must do, with wording, and a roll-out plan. Position as of October 2026.
The statutory hooks
- Section 8(2): a Data Fiduciary may engage a Data Processor to process personal data on its behalf "only under a valid contract".
- Section 8(1) and 8(5): the fiduciary remains responsible "irrespective of any agreement to the contrary", including for processing done by a processor, and must take reasonable security safeguards.
- Rule 6(1): minimum safeguards include encryption or masking, access control, logs and monitoring, backups, retention of logs and personal data for one year, and "appropriate provision in the contract" with the processor on security.
- Rule 7: breach notification to affected Data Principals without delay and to the Data Protection Board without delay, with a detailed report within 72 hours.
- Section 8(7)(b): the fiduciary must cause the processor to erase data when consent is withdrawn or the purpose ends, unless retention is required by law.
- Rule 15: transfer outside India is permitted subject to requirements the Central Government may specify by order.
- Schedule: penalties up to Rs 250 crore for failing to take reasonable security safeguards; up to Rs 200 crore for failing to notify a breach.
The DPDP Act does not prescribe the contract's contents the way the GDPR's Article 28 does; the content follows from the fiduciary's own obligations.
Clause by clause
1. Roles and scope.
"The Customer is the Data Fiduciary and the Provider is the Data Processor for the Personal Data described in Schedule 1. The Provider will process Personal Data only on the Customer's documented instructions and only for the Purposes in Schedule 1."
2. Security safeguards (rule 6).
"The Provider will implement and maintain the security safeguards in Schedule 2, which at a minimum include encryption or masking of Personal Data, access controls, logging and monitoring of access, backups enabling continuity, retention of logs for one year, and technical and organisational measures to ensure their effectiveness."
3. Breach notification (rule 7).
"The Provider will notify the Customer of any Personal Data Breach without delay and in any event within [12] hours of becoming aware, with the information the Customer needs to notify affected Data Principals and the Data Protection Board, and will provide updated information within [48] hours to enable the Customer's detailed report within 72 hours."
4. Sub-processors.
"The Provider will not engage a sub-processor without the Customer's prior written consent and will impose on each sub-processor obligations no less protective than this Agreement, remaining liable for its performance."
5. Personnel and confidentiality.
"The Provider will ensure that persons authorised to process Personal Data are bound by confidentiality and trained in the safeguards."
6. Assistance with Data Principal rights.
"The Provider will assist the Customer in responding to requests by Data Principals to access, correct, update or erase Personal Data, and to withdraw consent, within [5] business days of the Customer's request."
7. Hosting and transfers (rule 15; sector rules).
"The Provider will store and process Personal Data in [India] and will not transfer it outside India except as permitted by applicable law and with the Customer's prior written consent, complying with any requirements specified by the Central Government and, where the Customer is a regulated entity, by its regulator."
8. Erasure and return (section 8(7)).
"On the Customer's instruction, on withdrawal of consent or when the Purpose is no longer served, and in any event on termination, the Provider will return and then erase all Personal Data, including copies held by sub-processors, within [30] days, and certify erasure in writing, except to the extent retention is required by law."
9. Audit.
"The Provider will make available information demonstrating compliance and will permit audits by the Customer or its auditor on reasonable notice not more than once a year, or at any time after a Personal Data Breach."
10. Liability and indemnity.
"The Provider will indemnify the Customer for losses, including penalties imposed under the Digital Personal Data Protection Act, 2023, arising from the Provider's breach of this Agreement. This indemnity is not subject to the limitation of liability in the Services Agreement."
11. Term and precedence. The DPA runs with the services agreement and prevails over it on data matters.
Roll-out before 13 May 2027
- List every vendor that processes personal data on your behalf (cloud, payroll, CRM, support, analytics, logistics, e-signature).
- Classify by risk (volume, sensitivity, hosting location).
- Send the DPA as an addendum for electronic signature in bulk, highest risk first.
- Track acceptance, redlines and executed copies; escalate refusals.
- Record hosting location and breach-notification window per vendor in the register.
- Repeat for new vendors at onboarding.
Where Legatio fits. Legatio holds the DPA template, runs the bulk addendum campaign with e-signature and tracking, and records each vendor's DPA status, hosting location and notification window. The obligations are the DPDP Act's.
Position stated as of October 2026. General information, not legal advice.