Data Processing Agreements: Why They Matter For Businesses

Businesses increasingly rely on external service providers to store, analyse and manage personal information. Cloud platforms, payroll providers, SaaS applications, marketing agencies, customer support providers and IT vendors may all process personal data on behalf of a business. This makes data processing agreements an important part of modern privacy governance. A well drafted DPA defines how a service provider may handle personal data and establishes responsibilities around security, confidentiality, incidents, sub processors and deletion. In India, the Digital Personal Data Protection Act, 2023 introduces a specific framework for relationships between Data Fiduciaries and Data Processors. Section 8(2) provides for engagement of a Data Processor under a valid contract. However, businesses should also understand the phased commencement of the Act before describing every processor obligation as currently enforceable. (India Code)

What Is a Data Processing Agreement?

A Data Processing Agreement, commonly called a DPA, is a contractual arrangement governing the processing of personal data by one party on behalf of another. Under India's DPDP framework, the organisation determining the purpose and means of processing is generally the Data Fiduciary. A Data Processor is a person processing personal data on behalf of the Data Fiduciary. The relationship is therefore based on the actual processing activity rather than simply the title of the commercial contract. For example, an organisation may appoint a payroll company to process employee information, a cloud provider to host customer records or a customer service provider to manage support requests. Where the third party processes personal data on the organisation's behalf, the processing relationship should be clearly documented. A DPA may operate as a standalone agreement, a schedule to a master services agreement or an addendum to an existing commercial contract. The important point is not the document's title. It is whether the agreement clearly governs the personal data processing relationship.

Why Data Processing Agreements Matter for Businesses

Personal data can move through several organisations before a service reaches an individual. A customer may submit information through a company's website. The information may then enter a CRM platform, pass to a cloud hosting provider, be accessed by a customer support vendor and be analysed through another technology service. Without appropriate contractual controls, the business may have limited visibility over how those providers use the information. A DPA creates a contractual framework for controlling this processing. It can establish permitted purposes, security requirements, access restrictions, incident notification procedures, sub processor controls and deletion requirements. It also creates clearer accountability between the parties. This is particularly important because India's DPDP framework places significant responsibility on the Data Fiduciary for processing carried out on its behalf. A contract can allocate responsibilities and financial risk between the parties, but it should not be assumed to eliminate the Data Fiduciary's statutory responsibilities.

Data Fiduciary and Data Processor: Understanding the Difference

Correctly identifying the parties is the starting point for preparing a DPA. A Data Fiduciary determines the purpose and means of processing personal data. A Data Processor processes personal data on behalf of the Data Fiduciary. Consider a company using a cloud platform to store customer records. If the cloud provider processes the information only to provide the contracted hosting service, it may operate as a Data Processor. However, the same vendor could act as a Data Fiduciary for separate processing activities where it determines its own purposes. The contractual label should therefore reflect the actual relationship. Simply calling a vendor a “processor” does not resolve the legal analysis. Indian guidance increasingly emphasises this distinction because a single organisation can potentially have different roles for different processing activities.

What Does the DPDP Act Say About Processor Contracts?

Section 8 of the Digital Personal Data Protection Act contains the principal provisions concerning Data Fiduciaries and Data Processors. Section 8(2) provides that a Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for activities related to offering goods or services to Data Principals only under a valid contract. Section 8(1) also establishes the continuing responsibility of the Data Fiduciary for compliance with the Act in relation to processing undertaken on its behalf. These provisions are important because they make the vendor relationship part of the organisation's privacy governance framework. However, businesses should note the commencement position. The Government's commencement notification places Section 8 within the eighteen month commencement group following the November 2025 notification. The corresponding operational Rules are also subject to phased commencement. This distinction matters for accurate legal content and internal compliance planning.

What Should a Data Processing Agreement Include?

A DPA should be tailored to the actual service and data involved. A generic document may provide a useful starting point, but it should not replace a proper assessment of the processing relationship. Scope and purpose of processing The agreement should explain why the Processor receives personal data and what services it is authorised to perform. The Processor should not receive unrestricted permission to use personal information for its own purposes unless the parties have separately established the appropriate legal relationship and basis for such processing. A clear purpose clause reduces uncertainty. It also makes later compliance reviews easier because the business can compare actual processing against the contractual scope.

Categories of personal data

The DPA should identify the types of personal data involved. This may include names, contact information, account details, employment records, financial information, location information or other categories relevant to the service. The more sensitive or consequential the processing, the greater the need for precise contractual controls. 

Categories of Data Principals 

The agreement should also identify whose information is being processed. The Data Principals could be customers, employees, job applicants, suppliers, students, patients or website users. This information helps both parties understand the nature of the processing and the potential risks involved.

Duration of processing

The agreement should specify how long the Processor may process the information. The processing period should normally correspond with the service relationship and any legitimate retention period. A DPA should also explain what happens after the commercial contract ends.

Security Obligations Are Central to a DPA

A DPA should establish appropriate security obligations rather than relying on a general confidentiality clause. The DPDP Rules, 2025 identify security measures including encryption, masking or obfuscation, access controls, logging and monitoring, backups, retention of relevant logs and contractual provisions concerning security safeguards between Data Fiduciaries and Data Processors. The contractual standard should reflect the nature of the service. A vendor processing payroll information may require stronger access restrictions than a supplier receiving only limited business contact information. The agreement can also require the Processor to maintain appropriate technical and organisational measures, restrict privileged access, train authorised personnel and notify the Data Fiduciary of material security incidents. The objective is not to copy a technical checklist into every contract. It is to establish controls appropriate to the actual risk.

Confidentiality and Personnel Access

A Processor may have employees, contractors or other authorised personnel accessing personal data. The DPA should therefore establish confidentiality obligations for people authorised to process the information. Access should be limited to individuals who require it for their role. Access should also be removed when personnel change responsibilities or leave the organisation. Businesses should periodically assess whether vendor access remains necessary. A contractual confidentiality promise becomes much stronger when supported by practical access controls.

Data Breach and Incident Notification

A DPA should establish a clear incident notification process. The Processor should notify the Data Fiduciary promptly after becoming aware of a relevant personal data breach. The contract can also specify the information the Processor must provide, such as the nature of the incident, affected systems, categories of information, likely impact and containment measures. The purpose is to give the Data Fiduciary sufficient time to assess its own regulatory responsibilities. This becomes particularly important under the notified DPDP Rules. Rule 7 provides for notification of affected Data Principals without delay and establishes a process for notifying the Data Protection Board, including detailed information within 72 hours, subject to the Rule's requirements. The Processor's contractual notification period should therefore be short enough to support the Data Fiduciary's response.

Sub Processors Need Contractual Control

Many technology vendors rely on other service providers. A SaaS provider may use a cloud infrastructure company. A payroll platform may rely on another hosting provider. A customer support provider may use external communication systems. These entities can become sub processors within the wider processing chain. The DPA should therefore establish how sub processors may be appointed. Depending on the risk and commercial arrangement, the Data Fiduciary may require prior approval, advance notice or another appropriate control mechanism. The Processor should also remain responsible for ensuring relevant obligations flow through the processing chain where appropriate. Without sub processor visibility, a business may not know where its personal data ultimately resides.

Assistance With Data Principal Requests

Individuals may have rights under applicable data protection law. A Processor may hold information needed to respond to those requests even though the Data Fiduciary is responsible for managing the relationship with the individual. The DPA should therefore require reasonable assistance. For example, if an individual requests correction or erasure, the Processor may need to locate relevant information and implement the instruction. The agreement should establish practical procedures for such requests, including communication channels and reasonable response times. This helps prevent a situation where a business receives a request but cannot act because its vendor has no internal process for responding.

Retention, Return and Deletion

A DPA should address what happens when processing ends. The Processor may be required to return or delete personal data, subject to applicable legal retention requirements. Deletion should be considered across active systems, backups and other storage environments where relevant. The contract should also clarify whether the Processor must provide evidence of deletion. This becomes particularly important when a business changes vendors. The outgoing supplier should not retain personal information indefinitely simply because the commercial agreement has ended.

Audit and Compliance Evidence

Businesses need some method of verifying whether their Processors comply with contractual requirements. The DPA may establish audit rights, security assessments, independent certifications, compliance reports or other evidence mechanisms. The appropriate approach depends on the risk. A company processing large volumes of financial or health information may require stronger assurance than a low risk supplier. Unrestricted audit rights can also create practical problems for both parties. A well structured DPA can establish reasonable notice, scope, confidentiality and frequency rules while preserving meaningful oversight. Modern enterprise DPAs commonly address cooperation, assessments and audit evidence as part of the contractual framework.

Cross Border Data Processing

A vendor agreement should make international processing visible. A company may be based in India while its cloud provider stores information in another country. Support personnel may also access systems from overseas locations. Section 16 of the DPDP Act addresses processing outside India and permits the Central Government to restrict transfers to specified countries or territories through notification. Other sector specific requirements may apply independently. Businesses should therefore understand where vendors host, access and transfer personal data. The DPA should contain suitable provisions for international processing where required by the applicable legal framework. Businesses subject to the GDPR or other overseas privacy regimes may also need additional transfer mechanisms. A DPA designed for Indian law should not automatically be assumed to satisfy every foreign privacy requirement.

Liability, Indemnity and Insurance

A DPA is also a commercial risk allocation document. Businesses should examine how liability for privacy breaches, security incidents and contractual failures interacts with the main services agreement. A vendor may accept extensive privacy obligations but still have a low overall liability cap under its commercial contract. The parties should therefore consider the relationship between privacy obligations, indemnities, exclusions, insurance and liability limits. There is no universal clause suitable for every transaction. The appropriate allocation depends on the volume and sensitivity of information, the vendor's role, the business impact of a breach and the parties' negotiating position.

Data Processing Agreements and GDPR

Many Indian businesses work with international customers or vendors. As a result, their DPAs may need to address more than Indian law. Under Article 28 of the GDPR, controller and processor relationships must be governed by a contract containing specified requirements concerning processing instructions, confidentiality, security, sub processors, assistance and audits. The GDPR and DPDP Act use different terminology and structures. Indian contracts should therefore avoid simply copying a GDPR DPA without checking whether its provisions accurately reflect Indian law. Where both frameworks apply, businesses should map the requirements rather than assume one document automatically satisfies both.

Why Generic DPA Templates Can Create Problems?

Templates can save time, but a DPA should reflect the actual processing relationship.

A template designed for a cloud provider may not be appropriate for a payroll company. A template created for GDPR compliance may contain provisions irrelevant to an Indian only processing arrangement. The agreement should match the real data flow. If the vendor does not access certain categories of data, those categories should not be included merely because they appear in a standard form. If a vendor uses sub processors, the agreement should address them. If international processing occurs, the relevant provisions should be included. Accuracy is more valuable than unnecessary contractual length.

When Should Businesses Sign a DPA?

Ideally, the processing relationship should be assessed before the vendor receives personal data. Procurement teams should identify whether the supplier will process personal information during vendor selection. Legal and privacy teams can then determine whether a DPA or equivalent contractual provisions are required. The agreement should be finalised before operational access begins wherever the applicable legal framework requires contractual controls. Existing vendor arrangements should also be reviewed, particularly where they involve significant volumes of personal data or sensitive processing.

How Businesses Can Manage DPAs at Scale?

Large organisations may have hundreds of vendors. Managing each DPA manually can create gaps. A practical governance programme should maintain a central vendor register showing which suppliers process personal data, what information they receive, where processing occurs and when the agreement expires. Risk based classification can help prioritise reviews. High risk vendors can receive deeper security assessments and more detailed contractual review. Lower risk vendors can follow a proportionate process. Renewal workflows should also trigger privacy review. A contract should not automatically renew for several years while the underlying processing arrangement changes. This is where specialist data protection services for businesses can support contract reviews, vendor assessments and wider privacy governance where internal resources are limited.

What Businesses Should Review in Existing DPAs?

Existing agreements should be compared against current processing activities. The organisation should ask whether the vendor's role is still correctly classified, whether the permitted processing remains accurate, whether sub processors have changed, whether data is stored in new locations and whether security commitments match the vendor's current practices. Businesses should also review breach notification periods. A DPA negotiated several years ago may contain a notification period unsuitable for current regulatory expectations. The same applies to deletion clauses. The contract should reflect how the vendor actually handles backups, archives and account termination.

The Indian DPDP Transition and DPA Preparation

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Rule 1 provides for phased commencement. Rule 4 takes effect one year after publication, while Rules 3, 5 to 16, 22 and 23 take effect 18 months after publication. The Act's substantive provisions concerning Data Fiduciary obligations are similarly subject to the commencement notification. This means businesses should distinguish between preparation and current enforceability. The absence of full commencement should not be treated as a reason to ignore vendor contracts. Reviewing hundreds of commercial agreements, renegotiating supplier terms and changing vendor onboarding processes can take considerable time. Businesses can use the transition period to establish a consistent DPA framework and align contracts with actual data flows.

Conclusion

Data Processing Agreements have become an important part of responsible vendor governance. They provide a contractual structure for controlling how third parties handle personal data and help businesses translate privacy requirements into practical obligations. A strong DPA should do more than repeat general statements about compliance. It should reflect the actual processing relationship. It should identify the data involved, define permitted purposes, establish security requirements, control sub processors, provide a workable incident response process and address retention and deletion. For Indian businesses, the DPDP Act and the notified Rules make this area particularly important as the country moves towards full implementation of its new privacy framework. The phased commencement also gives businesses time to review existing vendor arrangements and build stronger contractual controls. A carefully prepared DPA cannot eliminate every privacy risk. It can, however, make responsibilities clearer, improve vendor accountability and provide an important contractual foundation for wider privacy governance. Businesses should also seek advice from experienced commercial lawyers where a DPA involves complex liability provisions, international processing, regulated data, substantial vendor dependencies or overlapping Indian and foreign privacy requirements.

Frequently Asked Questions (FAQs)

Q1. What is a Data Processing Agreement?

A Data Processing Agreement is a contract governing the processing of personal data by a Data Processor on behalf of a Data Fiduciary. It defines permitted processing and establishes contractual responsibilities concerning security, incidents, confidentiality and other privacy matters.

Q2. Is a Data Processing Agreement mandatory in India?

Section 8(2) of the DPDP Act provides that a Data Fiduciary may engage a Data Processor for covered activities only under a valid contract. However, Section 8 is subject to the phased commencement notification. Businesses should prepare processor contracts before the relevant provision becomes operational.

Q3. Who signs a Data Processing Agreement?

The agreement is generally entered into between the organisation acting as Data Fiduciary and the organisation acting as Data Processor. The exact contractual structure depends on the commercial relationship.

Q4. What should a DPA contain?

A DPA should normally address the purpose and duration of processing, types of personal data, categories of Data Principals, processing instructions, confidentiality, security, breach notification, sub processors, rights assistance, retention, deletion, audits and relevant international processing.

Q5. Is a DPA the same as a privacy policy?

No. A privacy policy or privacy notice explains how an organisation processes personal data and communicates information to individuals. A DPA governs a contractual relationship between a Data Fiduciary and Data Processor.

Q6.Does every vendor need a DPA?

Not necessarily. The relevant question is whether the vendor processes personal data on behalf of the organisation. A supplier with no access to personal data may not require a processor agreement. Some vendors may also act as independent Data Fiduciaries for certain activities.

Q7. Can a DPA transfer all legal responsibility to the vendor?

No. A contract can allocate responsibilities, costs and remedies between the parties, but it does not automatically remove statutory responsibility from the Data Fiduciary. The DPDP framework places important obligations on the Data Fiduciary for processing undertaken on its behalf.

Q8. Should a DPA include breach notification timelines?

Yes. A clear contractual notification mechanism is important because the Data Fiduciary may have its own regulatory notification duties. The Processor should notify the Data Fiduciary quickly enough to allow appropriate assessment and response.

Q9. What are sub processors?

Sub processors are third parties engaged by a Data Processor to perform part of the processing service. A DPA should establish appropriate controls over their appointment and processing activities.

Q10. Do DPAs need to address data deletion?

Yes. The agreement should establish what happens to personal data when the service ends, including return, deletion and any legally required retention.

Q11. Are DPAs required under GDPR?

Where Article 28 of the GDPR applies to a controller and processor relationship, the processing must be governed by a contract containing specified requirements.

Q12. Can one company be both a Data Fiduciary and a Data Processor?

Yes. An organisation may act as a Data Fiduciary for processing carried out for its own purposes and as a Data Processor when it processes another organisation's data on that organisation's behalf. The role should be assessed for each processing activity.