Data Processing Agreement (DPA)
A written contract between a Data Fiduciary and a Data Processor that sets how personal data may be handled.
A data processing agreement (DPA) is the contract between a company that decides how personal data is used and a vendor that handles the data for it. It sets out what the vendor may do, how it must protect the data and what happens at the end.
Meaning of Data Processing Agreement (DPA)
The Act allows processors to be used only under a valid contract. A good DPA covers instructions and purpose limits, security measures, sub-processors, breach notice, help with rights requests, deletion at the end and audit rights.
Section 8(2) of the DPDP Act allows a Data Fiduciary to engage, appoint, use or involve a Data Processor to offer goods or services to Data Principals only under a valid contract. Section 8(1) makes the Fiduciary responsible for processing done on its behalf, irrespective of any agreement, and Section 8(5) extends the duty of reasonable security safeguards to data processed by a processor. The DPA is the legal tool through which the Fiduciary controls a risk it cannot hand away.
The Rules strengthen this. Rule 6 expects appropriate provisions in the contract with a Data Processor to ensure those safeguards are taken, alongside encryption or similar measures, access control, monitoring and log retention. Rule 7 depends on the processor telling the Fiduciary quickly enough for the Fiduciary to inform the Board and the affected people without delay. A DPA that has no incident clause leaves the Fiduciary exposed.
A sound DPA states the subject matter and duration, the categories of data and people, and that the processor acts only on documented instructions and for no purpose of its own. It sets security measures, confidentiality of staff, rules on sub-processors, support for rights requests and grievances, breach notice within a fixed time, deletion or return at the end (matching Section 8(7)(b) and Section 6(6)), audit and information rights, and the location of processing for cross-border compliance under Section 16.
A DPA is different from a master services agreement, which governs commercial terms, although the DPA is often attached as a schedule. It also differs from a joint-controller or data sharing agreement, which applies when two Fiduciaries each decide purposes. The Act does not prescribe a template, and GDPR Article 28 is a familiar model, but adapt the content to Indian law instead of copying EU clauses on transfer mechanisms and legitimate interest.
Examples of Data Processing Agreement (DPA)
A retailer signs a DPA with its email-marketing provider that bars the provider from using subscriber data for its own purposes.
An online retailer signs a DPA with an email-marketing provider. The contract bars the provider from using subscriber addresses for its own campaigns, requires encryption and a 24-hour incident alert and obliges it to delete data within 30 days after termination.
A hospital outsources its billing software. The DPA limits access to billing staff, requires logs to be kept for at least a year, restricts hosting to named locations and obliges the vendor to assist with patient correction and access requests.
A SaaS start-up that stores customer data with a cloud provider reviews the provider's standard terms, attaches an addendum covering sub-processors and breach notice, and keeps both in its vendor register.
Why Data Processing Agreement (DPA) matters
Without a DPA, you may be unable to show that a processor is engaged under a valid contract, and you will lack remedies when it mishandles data. If a vendor suffers a breach, the Board looks to you as the Fiduciary. Penalties run up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to notify a breach, and they apply to the Fiduciary even when the cause lies with a vendor.
A good DPA also helps in commercial terms. It sets service expectations, indemnity and cost allocation, speeds up vendor onboarding for enterprise customers and lets both sides plan incident response before an incident.
How it works in practice
- 1Classify each vendor first. Decide whether it is a processor acting on your instructions, a Fiduciary in its own right or a joint decision-maker, because the contract differs.
- 2Draft or review the DPA against a checklist: instructions and purpose limits, security measures, breach notice, sub-processors, rights support, deletion, audit and location of data.
- 3Set concrete numbers. State the time in which the vendor must report an incident (hours, not days), the retention and deletion deadline and the standards it must maintain.
- 4Negotiate liability and indemnity in proportion to the risk, remembering that penalty exposure stays with you.
- 5Track all signed DPAs in a register with renewal dates and the vendor's sub-processor list, and re-check them when services change.
- 6At exit, invoke the deletion clause, collect proof and close access accounts.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on a vendor's standard terms of service as the DPA. These often leave out incident timelines, deletion and audit rights.
Signing once and never reviewing. Services, sub-processors and data flows change; the DPA should be reviewed with them.
Omitting a breach notice deadline, so the vendor tells you after your own reporting window has closed.
Believing the contract moves legal responsibility to the vendor. It supports your position but does not transfer your duty under Section 8(1).
Compliance tips
Keep a standard DPA template reviewed by counsel, and have procurement use it for every new vendor that touches personal data.
Ask vendors for evidence, such as security certifications or test summaries, and attach it to the contract file.
Align the DPA breach clause with your own breach plan so that internal and vendor timelines fit together.
Require a list of sub-processors and notice before any change, with a right to object.
Common questions about Data Processing Agreement (DPA)
Is a data processing agreement mandatory under the DPDP Act?
Section 8(2) permits a Data Processor to be engaged only under a valid contract, and Rule 6 expects security provisions in it. The Act does not use the word DPA, but a written agreement covering these points is the way to meet it.
What is the difference between a DPA and an NDA?
An NDA protects confidential information between parties. A DPA governs how personal data is handled, secured, shared and deleted, and supports legal duties towards Data Principals. A vendor handling personal data usually needs a DPA, not only an NDA.
Does a DPA make the vendor liable instead of me?
No. Section 8(1) keeps the Data Fiduciary responsible for processing on its behalf. The DPA lets you set duties, claim indemnity and require cooperation, but it does not remove your own responsibility to the Board and to individuals.
What should a DPA say about breaches?
It should require the vendor to notify you promptly, ideally within hours, with details of what happened, which data and people are affected and what has been done. This lets you meet your own obligations under Section 8(6) and Rule 7.