Data Processing Agreements Under DPDP
When you share personal data with vendors, cloud providers, or service partners, DPDP requires forma. Get expert help today.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For Data Processing Agreements Under DPDP, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Mandatory Sub-processor Authorization
Under Indian law, a Data Processor cannot hire another company to help with your data without your specific permission. Your existing contracts likely use “general consent” for sub-processors, which is now a compliance risk. You must list every third-party tool, server provider, and software library your processor uses to ensure they do not move data to unauthorized parties.
The Instruction-Only Mandate
The DPDP Act requires processors to act only on your documented instructions. Many standard service agreements allow processors to use “aggregated data” for their own product development or AI training. This creates a legal gap where the processor uses your data for their own benefit. Your agreements must explicitly ban any use of data that falls outside your specific service request.
| Workflow | Personal Data Involved | DPDP Risk |
|---|---|---|
| Cloud Hosting | User database backups | No proof of data deletion after contract end |
| CRM Integration | Customer names and emails | Processor adds data to their own marketing pool |
| Tech Support | Screen shares and IP addresses | Processing data beyond the support ticket purpose |
| Payment Gateway | Transaction IDs and phone numbers | Data stored in jurisdictions with restricted transfers |
This week
Pick your most critical software vendor and check the “Data Deletion” clause in their Terms of Service. Verify if they promise to delete your data within a specific number of days after the contract ends, as required for your DPDP compliance.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can I use my existing GDPR-compliant Data Processing Addendum for Indian clients?
No, because the Indian DPDP Act has different requirements for reporting data breaches to the Board. You must update the "Notice" section to match the specific timelines and formats required by Indian regulators.
Does a freelancer I hire on a contract count as a Data Processor?
Yes, if they handle any customer or employee information for your business. You need a signed agreement with them that limits their use of that data strictly to the tasks in their scope of work.
What happens if my processor loses data but our contract says they are not liable?
The DPDP Act holds you, the Fiduciary, responsible for the loss regardless of your private contract. You must update your DPAs to include indemnity clauses that cover the specific costs of regulatory penalties and data restoration.