Data Processor
A person or organisation that processes personal data on behalf of a Data Fiduciary.
A Data Processor handles personal data on behalf of a Data Fiduciary and follows its instructions. It does not decide why the data is used.
Meaning of Data Processor
A processor does not decide the purpose of processing. It acts on the fiduciary's instructions. The Act allows a fiduciary to use a processor only under a valid contract, and the fiduciary stays responsible for the processing. If a processor starts deciding its own purposes, it becomes a fiduciary for that use.
Section 2(k) defines a Data Processor as a person who processes personal data on behalf of a Data Fiduciary. The key words are "on behalf of". The processor works within the purposes and instructions set by the fiduciary. Typical processors include cloud hosts, payroll bureaus, email and SMS gateways, customer-support outsourcers, analytics tools and data-entry vendors.
Section 8(2) allows a Data Fiduciary to engage a processor for offering goods or services only under a valid contract. The Act does not list contract terms, but the duties in Section 8, especially security under Section 8(5), erasure under Section 8(7) and breach intimation under Section 8(6), must be carried through. Section 6(6) also requires the fiduciary to cause its processors to stop processing when consent is withdrawn, and Section 8(7)(b) makes it cause processors to erase data.
The Act places responsibility on the fiduciary, not directly on the processor. Section 8(1) says the fiduciary remains responsible for processing done on its behalf irrespective of any agreement. This differs from GDPR, which imposes direct obligations on processors. The processor can still face consequences as a person who breaches the Act or the Rules, and it is bound by its contract, by CERT-In directions and by sectoral rules.
Role can change by activity. A payments gateway might be a processor for merchants when moving funds, but a fiduciary for its own fraud-scoring models. A processor that uses client data to build products for itself is acting as a fiduciary for that purpose. Sub-processors, such as a cloud region provider used by a SaaS vendor, should be known to the fiduciary and covered by the chain of contracts.
Examples of Data Processor
A cloud provider that stores a retailer's customer database is a Data Processor for the retailer.
A retailer uses a courier-management platform to print labels and track parcels. The platform processes customer names and addresses only for deliveries. It is a processor under contract, and the retailer decides what the platform may receive.
A company outsources payroll to a bureau. The bureau processes salary and bank details under written instructions, and returns all files when the contract ends. When an employee asks for correction, HR informs the bureau to update its records.
A marketing analytics tool starts using client customer data to improve its own audience-matching product. Because it now decides a purpose of its own, it acts as a fiduciary for that use and needs its own ground and notices.
Why Data Processor matters
Outsourcing does not outsource accountability. A leak at a vendor can lead the Board to penalise the fiduciary, with the maximum for security failures at ₹250 crore. A vendor that mishandles data also loses business quickly, since enterprise buyers now ask for evidence of controls before awarding contracts.
For processors, this makes compliance a selling point. Indian IT and BPO firms that handle data for banks, insurers and foreign clients are now expected to show access control, logging and incident readiness aligned with Rule 6 and Rule 7.
How it works in practice
- 1Fiduciaries should run vendor due diligence: ask for security certifications, penetration test summaries, incident history, data location and sub-processor lists before onboarding.
- 2Sign a written data processing agreement that fixes purposes, categories of data, permitted instructions, security measures, breach notification timelines, assistance with rights requests, audit rights and return or erasure at exit.
- 3Processors should limit access on a need-to-know basis, keep logs, encrypt data in transit and at rest, and avoid using client data for any other purpose.
- 4Agree on a breach drill: who calls whom, how quickly, and what information is shared so the fiduciary can meet the Rule 7 timelines of notifying the Board without delay and filing a detailed report within 72 hours.
- 5At the end of the contract, require certified deletion or return of the data, including backups, within a stated time.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on a standard vendor click-through agreement. Negotiate the terms that matter: security, breach timelines, sub-processors, audit and deletion.
Assuming the Act makes only the processor liable for vendor failures. The fiduciary stays responsible under Section 8(1).
Not knowing the vendor's own sub-processors or where data is stored. Ask for the list and notice requirements for changes.
Processors using client data for their own testing or product training without permission. That can turn them into fiduciaries.
Compliance tips
Maintain a vendor register with data categories, contract date, security review date and exit plan for each processor.
Include a clause requiring prompt notice to you, within hours rather than days, of any suspected incident.
Give processors only the fields they need. Mask or tokenise where possible.
Review key processors annually, and after any breach in their sector, through questionnaires and sample evidence.
Common questions about Data Processor
Who is a Data Processor under the DPDP Act?
Any person who processes personal data on behalf of a Data Fiduciary, such as a cloud host, payroll vendor or call-centre provider. It follows the fiduciary's instructions and does not set the purposes of processing.
Is a Data Processor liable under the DPDP Act?
The Act places primary responsibility on the Data Fiduciary under Section 8(1). A processor can still face consequences as a person who breaches the Act, and is bound by contract and sectoral rules, so it should maintain proper safeguards.
Is a contract mandatory with a Data Processor?
Yes. Section 8(2) says a fiduciary may engage a processor to offer goods or services to Data Principals only under a valid contract. Put the security, breach, audit and deletion terms in writing.
Is a Data Processor the same as a data fiduciary's employee?
No. Employees act as part of the fiduciary itself. A processor is a separate person, like a vendor or service provider, that handles data on the fiduciary's behalf under a contract.