Data Privacy · DPDP Act

What is a Data Processing Agreement (DPA) and Which Vendors Need One?

Published 16 October 2026 · 8 min read · Researched by Rakesh Jaiswar, LLB student, Mumbai

Your SaaS runs on Razorpay, Google Workspace, a WhatsApp Business API provider, maybe a payroll tool and an email platform. Every one of those vendors is handling your customers' personal data. Under India's DPDP Act, you remain responsible for what they do with it — and a Data Processing Agreement (DPA) is how you put the rules of that relationship in writing.

First: Who is a Data Processor?

The DPDP Act, 2023 draws a clean line between two roles:

A Data Fiduciary is the entity that decides why personal data is collected and how it is used. That is your business.
A Data Processor is any entity that processes personal data on behalf of the Data Fiduciary — on your instructions, not for their own purpose. That is your vendor.

This is not just a labelling exercise. If your email marketing platform sends spam to your customers because they mishandled your contact list, the complaint under the DPDP Act lands with you first. You engaged the vendor, you provided the data, and you are the Data Fiduciary answerable to your customers.

What is a Data Processing Agreement?

A DPA is a contract between you (Data Fiduciary) and the vendor (Data Processor) that governs exactly how the vendor may handle the personal data you share with them. Section 8(2) of the DPDP Act requires that a Data Fiduciary engage Data Processors only through a valid contract.

Think of it as the vendor's operating manual for your customers' data. It answers:

What data can they process, and for what purpose only?
Can they store the data outside India?
What security measures must they maintain?
What happens if there is a breach?
Can they engage sub-processors (their own vendors)?
What happens to the data when the contract ends?

Commencement timeline: The core obligations under the DPDP Act — including the Data Processor contract requirement — come into force approximately May 2027 under the phased commencement schedule. Waiting until then is the wrong call. Your vendors are processing data today, and negotiating DPA terms takes time. Draft these now.

Which Vendors Actually Need a DPA?

Not every vendor relationship requires a formal DPA. The question is whether this vendor processes personal data on your behalf — meaning your customers' names, emails, phone numbers, payment details, or any other personal data pass through their systems.

Vendor Type	Processes Your Customer Data?	DPA Needed?
Email marketing platform (Mailchimp, Zoho Campaigns)	Yes — stores and sends to your subscriber list	Yes
Payment gateway (Razorpay, PayU)	Yes — processes customer payment and contact data	Yes
Cloud storage / hosting (AWS, Netlify, Google Cloud)	Yes — if customer data is stored there	Yes
Payroll / HRMS software	Yes — processes employee personal data	Yes
WhatsApp Business API provider	Yes — sends messages to your customers	Yes
CRM (Zoho CRM, HubSpot)	Yes — stores customer names, emails, call logs	Yes
Accounting software (Zoho Books, Tally)	Partial — client invoice data and contact details	Yes, if client personal data stored
Office supply vendor / courier (no data access)	No	No
Freelance designer (no customer data shared)	No	No — but consider an NDA

Quick test: If a vendor's system contains a list of your customers' names, emails, or phone numbers — even just as an export file — they are a Data Processor. A DPA belongs in that relationship.

What Must a DPA Cover?

Section 8(2) of the DPDP Act requires a valid contract. The Rules (particularly Rules 7, 8, 12 and 13) together with the Act establish what that contract must address:

1. Processing Only on Instructions

The vendor may process data only for the purpose you specify and in the manner you direct. They cannot use your customer list to upsell their own products, share it with a third party, or retain it beyond the engagement. This must be explicit in writing — it cannot be assumed.

2. Security Obligations

Rule 8 of the DPDP Rules requires Data Fiduciaries to implement appropriate technical and organisational security measures. Your DPA must impose equivalent obligations on the vendor — encrypted storage, access controls, and incident response procedures.

3. Breach Notification

Rule 7 requires you to notify the Data Protection Board and affected Data Principals of a personal data breach — in two stages: an initial intimation without delay, then a detailed report within seventy-two hours. Since your vendor holds the data, the DPA must require them to inform you within 24–48 hours of discovery so you can meet your own obligation.

4. Sub-Processor Rules

Your email platform likely uses Amazon SES or another infrastructure vendor behind the scenes. Your DPA should specify whether sub-processors are permitted, and if so, that the same data protection obligations flow down to those sub-processors — this is your liability chain.

5. Cross-Border Data Transfers

The DPDP Act restricts transfer of personal data to countries notified as restricted by the Central Government (Rule 12). If your vendor uses servers outside India — AWS US-East, Google's European data centres — your DPA needs to address this and confirm the transfer is permissible.

6. Return or Deletion on Termination

When the engagement ends, the DPA must require the vendor to return all personal data or securely delete it — within a defined timeframe — and provide written confirmation that deletion is complete. Rule 8(3) also requires a minimum one-year log retention for Seventh Schedule purposes, which your DPA should address.

7. Audit Rights

You need the contractual right to verify the vendor is actually following the DPA's obligations — either through your own audit or by requesting documentation of their compliance practices. Without this, the contract is unenforceable in practice.

SPDI Rules still apply until ~May 2027: The IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011 remain the operative privacy law until the DPDP Act's core obligations commence. A robust DPA drafted today should also reflect SPDI Rules compliance — particularly Rule 8, which governs disclosure of SPDI to third parties such as your vendors.

A Practical Note on Large Platforms

Google, Razorpay, AWS, and most enterprise SaaS vendors already have their own standard DPA or Data Processing Addendum incorporated into their Terms of Service. When you sign up, you are typically accepting their terms which include data processing obligations by reference.

For those vendors, the question is not whether a DPA exists — it is whether the terms actually protect you adequately. Read what their standard DPA says before assuming it is sufficient.

For smaller or local vendors — a WhatsApp Business API reseller, a regional payroll service, a freelance developer with database access — they likely have no DPA at all. That gap is where the risk sits, and where you need to act.

What if a Vendor Refuses to Sign?

Common situation

Smaller Indian vendors — local payroll services, regional software providers — often have no DPA template and may be reluctant to sign one. This is a real and common obstacle.

A few practical options:

Negotiate the essentials: Processing limitation, breach notification timeline, and deletion on termination. A vendor who will not agree to even these basics is a genuine risk.
Incorporate into the service agreement: If the vendor will not sign a standalone DPA, add the data processing obligations as a dedicated schedule in the main service contract. Less clean structurally, but legally equivalent.
Document your attempts: If a vendor categorically refuses, document that you requested a DPA and they declined. This shows a regulator you took reasonable steps.
Reconsider the vendor: A vendor handling significant volumes of your customers' personal data but refusing any contractual accountability is a vendor-selection issue, not just a contract issue.

Where to Start: Four Vendors First

You do not need a separate DPA for every vendor relationship immediately. Start with the four that carry the most data and the highest risk: your email platform, payment gateway, CRM, and cloud infrastructure. Get those four in order before working outward through the rest of your vendor stack.

The DPDP Act's obligations come into force around May 2027. But the data is flowing now — and the businesses that sort out vendor agreements before the deadline will be the ones that sleep well when enforcement begins.

Data Processing Agreement Template — ₹999

DPDP Act and SPDI Rules compliant. Covers processing limitations, breach notification (two-stage Rule 7 procedure), sub-processor obligations, cross-border transfer, log retention, and termination. Researched and verified by Rakesh Jaiswar, LLB student, Mumbai.

Get the DPA Template — ₹999

✓ 7-day full refund guarantee · Instant delivery on payment

Legal references: Digital Personal Data Protection Act, 2023 (Sections 8(2)); DPDP Rules, 2025 (Rules 7, 8, 12, 13); Information Technology (SPDI) Rules, 2011 (Rule 8). Commencement timeline per Gazette Notification G.S.R. 899(E), 11 November 2025 — phased schedule: Rules 1, 2, 17–21 in force immediately; Rule 4 (Consent Managers) after one year (~Nov 2026); Rules 3, 5–16, 22–23 eighteen months after publication (~May 2027).
Last verified: October 2026 by Rakesh Jaiswar, LLB student, Mumbai. General information only — not legal advice. Consult an enrolled advocate before execution.