Data privacy (DPDP Act, 2023) · Template
The DPDP Act does not let you outsource responsibility along with the data. If a vendor processes personal data on your behalf, s. 8(5) requires that engagement to sit under a valid contract — and if they lose it, you are still the fiduciary answering for it. A DPA addendum is how that contract gets added without reopening the commercial terms.
Quick Statutory Answer
Do I need a DPA with every vendor? With every vendor that processes personal data on your behalf. Section 8(5) of the DPDP Act, 2023 permits engaging a processor only under a valid contract, and that reaches further than most businesses expect — payroll providers, CRM and support tools, delivery partners, analytics and email platforms all commonly qualify.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
PARTIES
This Data Processing Agreement Addendum ("Addendum") is entered into as of [Effective Date] and forms part of the commercial agreement between:
Data Fiduciary: [Your Business Name], having its principal place of business at [Your Registered Address] ("Business").
Data Processor: [Vendor / Partner Name], having its principal place of business at [Vendor's Registered Address] ("Vendor"), engaged to provide: [Services the Vendor Provides].
RECITALS
WHEREAS, in the course of providing the above services, the Vendor will process personal data on behalf of the Business; AND WHEREAS the Business, as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023, is required to ensure that any Data Processor engaged by it observes appropriate data protection standards;
NOW, THEREFORE, the parties agree as follows:
TERMS AND CONDITIONS
1. Scope and Purpose Limitation. The Vendor shall process the following categories of personal data: [Categories of Data Shared with This Vendor], solely for the purpose of providing the services described above, and for no other purpose without the Business's prior written consent.
2. Confidentiality. The Vendor shall treat all personal data received from the Business as strictly confidential and shall ensure that access is limited to personnel who require it to perform the services.
3. Security Safeguards. The Vendor shall implement and maintain reasonable security safeguards, including: [Security Measures Required], to protect personal data against unauthorised access, disclosure, alteration, or destruction, consistent with Section 8(5) of the DPDP Act, 2023.
4. Sub-Processing. The Vendor shall not engage any sub-processor to process the personal data covered by this Addendum without the Business's prior written consent, and any approved sub-processor shall be bound by data protection obligations no less protective than those in this Addendum.
5. Breach Notification. In the event of any actual or suspected personal data breach, the Vendor shall notify the Business without undue delay and in any event within [Vendor Must Notify You of a Breach Within] hours of becoming aware of the breach, providing all information reasonably necessary for the Business to meet its own regulatory notification obligations.
6. Data Return or Deletion. Upon termination or expiry of the underlying commercial agreement, the Vendor shall, at the Business's election, promptly return or securely delete all personal data processed under this Addendum, save where retention is required under applicable law.
7. Audit Rights. The Business (or its authorised representative) may, upon [Notice Period for Compliance Audits] days' written notice, audit the Vendor's data protection practices as they relate to the services covered by this Addendum.
8. Indemnity. The Vendor shall indemnify the Business against any loss, liability, or regulatory penalty arising directly from the Vendor's breach of this Addendum.
9. Term. This Addendum shall remain in effect for so long as the Vendor processes personal data on behalf of the Business under the underlying commercial agreement.
10. Governing Law. This Addendum shall be governed by the laws of the Republic of India, including the DPDP Act, 2023 and rules framed thereunder.
EXECUTION
IN WITNESS WHEREOF, the authorised representatives of both parties have executed this Addendum as of the date first written above.
What the law behind this document actually requires.
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| Scope: categories, purposes and duration | What data, for what, for how long. A DPA that does not bound the processing authorises all of it. | DPDP Act, 2023 — s. 8(5) |
| Processing only on documented instruction | The processor acts for your stated purpose, not its own. Without this, vendor use of your customer data for its own analytics is not clearly a breach. | DPDP Act, 2023 — s. 8(6) |
| Security safeguards | Reasonable security safeguards are an obligation the fiduciary carries. The addendum passes a defined standard down and gives you something to audit against. | DPDP Act, 2023 — the Schedule |
| Sub-processing controls | Prior authorisation, and flow-down of the same obligations. Most breaches happen a layer below the vendor you actually chose. | DPDP Act, 2023 — s. 8(5) |
| Breach notification, with a stated window | You cannot meet the s. 8(6) intimation duty if you learn about the breach late. Fix a short window and require enough detail to act on. | DPDP Act, 2023 — s. 8(6) |
| Assistance with data principal rights | Access, correction and erasure requests reach you but the data often sits with the vendor. Their cooperation has to be contractual. | DPDP Act, 2023 — the Schedule |
| Deletion or return on termination | With written confirmation. A vendor that keeps a copy after exit is a liability you no longer have visibility into. | DPDP Act, 2023 — s. 8(5) |
With every vendor that processes personal data on your behalf. Section 8(5) of the DPDP Act, 2023 permits engaging a processor only under a valid contract, and that reaches further than most businesses expect — payroll providers, CRM and support tools, delivery partners, analytics and email platforms all commonly qualify.
Not on its own. A GDPR DPA is built around a different statute and will not reference the DPDP Act's own duties, including the s. 8(6) breach intimation requirement and the rights framework in ss. 11 to 13. An India-specific addendum, or an amendment to the GDPR DPA, is needed.
The data fiduciary carries the obligations under the Act, and penalties under the Schedule are assessed accordingly. A DPA does not transfer that exposure; it establishes the vendor's obligations to you and gives you a contractual route to recover, which is a different thing.
Short enough that you can still meet your own intimation duty under s. 8(6) after receiving it. Because your obligation runs from the breach rather than from the vendor's disclosure, the contractual window has to leave you time to act, not consume it.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.