DPDP and Your Vendor Contracts: What to Fix Before May 2027

Designed by Magnific

DPDP and Your Vendor Contracts: What to Fix Before May 2027

Authors: Shrishti Sharma (Ms.) and Tushar Todi (Mr.)

Date of First Publication: October 27, 2026

Most obligations under the Digital Personal Data Protection Act, 2023 (the ‘DPDP Act’ or ‘Act’) and the Digital Personal Data Protection Rules, 2025 (the ‘DPDP Rules’ or ‘Rules’) take effect on 13 May 2027 (computed as explained below).

This insight is for businesses that use vendors to process personal data on their behalf, such as cloud, CRM, payroll and call centre providers, and for the legal, procurement and IT teams that manage those contracts. The DPDP Act applies to digital personal data processed in India, and to processing outside India in connection with offering goods or services to individuals in India. In this insight, ‘you’ means a business that uses vendors to process personal data on its behalf, and ‘vendor’ means a supplier that processes personal data for such a business. Personal data processed by the State is not covered in this insight.

Under section 8(2) of the Act, you may process personal data via a vendor on your behalf for any activity related to offering goods or services to Data Principals only under a valid contract, often called a data processing agreement. If an existing agreement does not comply with the DPDP Act and DPDP Rules, you will need to renegotiate or amend it.

The following three terms from the Act are used throughout this insight:

Phased commencement of the Act and Rules

Until then, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to apply.

A vendor contract signed now will need to work under the existing regime until 13 May 2027, and under the DPDP Act and DPDP Rules from that date.

The notifications do not state the 13 November 2026 or the 13 May 2027 dates. G.S.R. 843(E) and Rule 1 of the DPDP Rules (as corrected by G.S.R. 892(E)) give only the periods, one year and eighteen months from publication, and the calendar dates above are computed accordingly. The Gazette is dated 13 November 2025, but the electronic copy carries a digital signature dated 14 November 2025, and some commentators arrive at the 14th. In our view, it is prudent to work with the 13th.

The contract is mandatory, but the liability remains with you

Section 8(2) of the Act allows you, as a Data Fiduciary, to engage a Data Processor only under a valid contract. On a plain reading, the section applies to processing for any activity related to offering goods or services to Data Principals. Processing by a cloud host, CRM provider or call centre will usually fall within it, as will processing by an analytics provider that acts only on your instructions.

Section 8(1) makes you responsible for complying with the Act and the Rules for processing done on your behalf by a Data Processor, “irrespective of any agreement to the contrary”. Section 8(5) places the duty on you to take reasonable security safeguards, including for processing by your Data Processor.

It is less clear whether section 8(2) covers vendors that handle only employee data, such as a payroll provider. It would still be prudent to put a contract on the same terms in place with them, because sections 8(1) and 8(5) apply to all processing done on your behalf, irrespective of the purpose.

Read together, these provisions mean that you need the contract but cannot use it to shift your regulatory liability. If a vendor’s security fails, the Board can hold you responsible. An indemnity may let you recover some of your loss from the vendor. The words “irrespective of any agreement to the contrary” in section 8(1) prevent the contract from moving the obligation to the vendor, but whether they also prevent you from recovering a Board penalty under an indemnity is untested, as section 8 is not yet in force.

When the Board decides a penalty, it must have regard to, among other things, whether the person took action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action. A contract that requires your vendor to report a breach within a fixed number of hours and to cooperate in the response supports a quick response.

What a DPDP data processing agreement should contain

The Act and Rules expressly place only two requirements on the contract itself. It must exist where the processing relates to offering goods or services to Data Principals (section 8(2)), and it must contain appropriate provision, wherever applicable, for the Data Processor to take reasonable security safeguards (Rule 6(1)(f)).

The Act and Rules also make you responsible for ensuring that your Data Processor does three things, so the contract should cover them:

Items 2 and 3 above run together. Section 8(7) says when erasure falls due, but the one-year period under Rule 8(3) runs from the date of each processing, so erasure arguably happens at whichever is later. Item 3 does not conflict with item 1. Keeping the data counts as processing, because ‘processing’ includes storage, but item 1 does not apply to processing that the Rules require, and Rule 8(3) arguably requires it.

These duties fall on you, not on the Data Processor, so the contract is the practical means of making the Data Processor carry them out. The list below covers such duties, along with terms the Act and Rules do not spell out but which you will need in order to meet your own obligations.

Breach intimation and the 72-hour period

The Act defines a personal data breach widely. It covers any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability. Rule 7 applies to any personal data breach and sets no materiality threshold for intimation. Whether the Board imposes a penalty is a separate question, because section 33(1) requires it to find that the breach of the Act or Rules is ‘significant’.

Section 8(6) requires you to intimate a breach to the Board and to each affected Data Principal, and Rule 7 sets two obligations once you become aware of a breach.

Both obligations run from when you become aware. The Rules do not say whether your Data Processor’s knowledge counts as yours. Given the responsibility under section 8(1), it would be unsafe to rely on a vendor’s delay as an answer to a late intimation.

If the vendor’s awareness is treated as yours and the contract gives the vendor seventy-two hours to tell you, your window can close before you hear of the breach. Even if the vendor’s awareness is not treated as yours, you start late on mitigation, and the timeliness of mitigation is one of the factors the Board considers in setting a penalty.

The contract should give the vendor a fixed number of hours to tell you about a breach. That number should be well inside seventy-two hours, because Rule 7 allows that time only for the detailed report to the Board. The first description to the Board and the intimation to Data Principals are due without delay, and you need time to investigate before either can be made. A mere requirement to notify “promptly” or “without undue delay” under the contract gives you nothing to enforce.

Retention and erasure

The Act requires personal data to be erased, the Rules require it to be kept for a minimum period first, and the vendor contract should deal with both.

Section 8(7) is the general rule on erasure. You must erase personal data when the Data Principal withdraws consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, unless retention is necessary to comply with a law. You must also cause your Data Processor to erase the personal data you made available to it. Separately, a Data Principal can ask for erasure of data processed on the basis of consent, and you must erase it unless retention is necessary for the specified purpose or to comply with a law (section 12(3)). Section 8(7) does not apply to every Data Fiduciary: the Central Government may exempt notified classes, including startups (section 17(3)), and it does not apply to processing by the State (section 17(4)).

Against that, Rule 8(3) requires you to keep personal data, associated traffic data and other logs of the processing for at least one year from the date of processing, including processing done on your behalf by a Data Processor. The retention is for the purposes in the Seventh Schedule to the Rules, namely use of the data by the State or its instrumentalities (for sovereignty, integrity and security, for functions under law, or for disclosures required by law) and the Central Government’s assessment for notifying a Data Fiduciary or class as a Significant Data Fiduciary. After that period, you must cause the data and logs to be erased, unless further retention is required to comply with another law or as notified by the Government.

The illustration to Rule 8(3) gives two cases. In the first, an e-book platform must keep order details, personal data and logs for at least one year from the transaction even if the customer deletes their account. In the second, a company that uses a cloud provider to host customer records must ensure the provider also keeps the data and logs for at least one year before erasure, unless another law requires longer. The safer reading is that personal data and logs processed for you are kept for a year from the date of each processing, even if the Data Principal withdraws consent or asks for erasure.

For three classes of large platform mentioned below, Rule 8(1) and the Third Schedule set a fixed period of inactivity after which the purpose is treated as no longer served (section 8(8)) and the data must be erased:

The period is three years from the date the Data Principal last approached the platform for the specified purpose or exercised their rights, or from commencement of the Rules, whichever is latest. The Third Schedule does not say which commencement date it means, and the Rules commence in stages (Rule 1). The period does not apply to processing needed to let the Data Principal access their user account, or to access a virtual token held on the platform that can be used to get money, goods or services. At least forty-eight hours before the period ends, the platform must tell the Data Principal that the data will be erased unless they log in, otherwise contact it or exercise their rights (Rule 8(2)). If they do, the three-year period starts again.

The one-year and three-year periods measure different things. The one-year period is a floor for each item of data or log, counted from the date it was processed. The three-year period fixes when the purpose is treated as no longer served, counted from the Data Principal’s last approach or exercise of rights. Erasure then arguably falls due, for each item, at whichever date is later. For most data of an inactive user, that is the three-year date, and the one-year floor matters only for items processed shortly before it.

The vendor contract should therefore require the vendor to keep personal data, associated traffic data and logs for at least one year from the date of each processing, and not to erase them earlier. After that, the vendor should erase them within a fixed number of days of your instruction and confirm in writing that it has done so. When you give that instruction depends on your own obligations: the Data Principal withdrawing consent, the purpose no longer being served and, if you are one of the three classes above, the end of the three-year period. The vendor should also produce the retained data and logs on request, so that you can respond if the Central Government calls for information (section 36 and Rule 23), and should bind its sub-processors to the same terms.

DPDP penalties and how the Board sets them

The Schedule to the Act sets maximum penalties:

The last entry is the residual one. Engaging a Data Processor without a valid contract, or failing to erase, would arguably fall under it. A contract that lacks the security provision required by Rule 6(1)(f) is arguably a failure to take reasonable security safeguards under section 8(5). Rule 6(1) repeats the words of section 8(5) and says the safeguards include, at the minimum, appropriate provision in the contract with the Data Processor. That would put the omission under the first entry in the Schedule, with its ₹250 crore ceiling.

These are ceilings, and a penalty is not automatic. Under section 33(1), the Board may impose a penalty only where it determines, on concluding an inquiry, that the breach is significant, and only after hearing the person concerned. Under section 33(2), the Board must have regard to the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the breach was repeated, any gain made or loss avoided, the mitigation taken and how timely and effective it was, whether the penalty is proportionate and effective, and its likely impact on the person penalised.

Where to start

Common questions on DPDP vendor contracts

When do DPDP obligations take effect?

Most commence on 13 May 2027, eighteen months after the DPDP Rules were notified on 13 November 2025. The notifications give only the period, so the date is computed, and it is prudent to work to the 13th (see ‘Phased commencement of the Act and Rules’). Consent Manager registration under Rule 4 commences earlier, on 13 November 2026.

Does the DPDP Act require a data processing agreement with vendors?

Yes, where the vendor is a Data Processor and the processing relates to offering goods or services to Data Principals. Section 8(2) of the DPDP Act permits you to engage a Data Processor for that purpose only under a valid contract, and Rule 6(1)(f) of the DPDP Rules requires appropriate provision in that contract, wherever applicable, for reasonable security safeguards. Neither says the contract must be in writing, but a written contract is the practical way to show that it contains that provision. It is prudent to treat every Data Processor the same way, including those that handle only employee data.

Can you pass DPDP liability to your vendor?

No. Section 8(1) of the DPDP Act keeps you responsible for processing done on your behalf, irrespective of any agreement to the contrary. The regulatory obligation stays with you. A contract can allocate commercial risk between the parties, but whether it can shift the cost of a Board penalty, for example through an indemnity, is untested.

How quickly must a data breach be reported under the DPDP Rules?

Under Rule 7, affected Data Principals and the Data Protection Board must be told without delay. The Board must then receive detailed information within seventy-two hours of you becoming aware of the breach, or within a longer period that the Board allows on a written request.

How long must personal data be kept before it is erased?

At least one year from the date of processing. Rule 8(3) of the DPDP Rules requires you to keep personal data, associated traffic data and other logs of the processing for that period, including where a Data Processor does the processing for you, so your vendor should be bound to the same period by contract. After that, the data and logs must be erased unless another law requires longer retention.

Does the three-year erasure period apply to every business?

No. It applies only to e-commerce entities and social media intermediaries with at least two crore registered users in India, and to online gaming intermediaries with at least fifty lakh registered users in India (Rule 8(1) and the Third Schedule). Every other Data Fiduciary has no fixed period and must erase under section 8(7) of the DPDP Act as soon as it is reasonable to assume that the specified purpose is no longer being served.

This insight is for general information only and is not legal advice. It reflects the position as at 26 October 2026.

Shrishti Sharma (Ms.) and Tushar Todi (Mr.)

Shrishti Sharma (Ms.)

Tushar Todi (Mr.)

• Tushar Todi (Mr.)

  #molongui-disabled-link

  DPDP and Your Vendor Contracts: What to Fix Before May 2027
• Tushar Todi (Mr.)

  #molongui-disabled-link

  Electricity (Amendment) Bill, 2025: Legal Implications for Distribution Licensing and Shared Distribution Systems