What Should a Data Processing Agreement Include in India?

A data processing agreement is an important contract for businesses working with service providers that process personal data on their behalf. It defines the responsibilities of the Data Fiduciary and Data Processor and establishes how personal data must be handled during the relationship. In India, the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to engage a Data Processor for relevant activities only under a valid contract. Section 8 also keeps the Data Fiduciary responsible for compliance with the Act and its rules for processing carried out by a Data Processor. A well drafted agreement should do more than repeat statutory language. It should explain precisely what information is processed, why it is processed, who can access it, how it is protected and what happens when the business relationship ends.

What Is a Data Processing Agreement?

A Data Processing Agreement, commonly called a DPA, is a contractual arrangement between a Data Fiduciary and a Data Processor. Under India’s DPDP framework, the Data Fiduciary determines the purpose and means of processing personal data, while a Data Processor processes personal data on behalf of the Data Fiduciary. A processor may include a cloud service provider, payroll provider, customer relationship management platform, payment service provider or technology vendor. The DPA establishes the boundaries within which the processor may handle personal data. It can form part of a master services agreement, technology contract, subscription agreement or another commercial arrangement. The precise wording should reflect the actual relationship. A generic agreement may leave important risks unresolved.

Why Is a Data Processing Agreement Important in India?

Section 8(2) of the DPDP Act provides that a Data Fiduciary may engage a Data Processor for processing personal data on its behalf for activities connected with offering goods or services to Data Principals only under a valid contract. Section 8(1) also makes the Data Fiduciary responsible for compliance concerning processing undertaken by the Data Processor. This makes contractual control an important part of data protection governance. A DPA can help the parties translate their legal obligations into operational responsibilities. It can establish security requirements, define permitted processing, regulate subcontracting and create procedures for dealing with data breaches. It can also provide evidence of a structured approach to vendor risk management.

What Should a Data Processing Agreement Include?

A strong DPA should be tailored to the services being provided. Current Indian DPA structures commonly address the parties and their roles, processing scope, security measures, sub processors, breach notification, rights assistance, audits, international transfers and return or deletion of information. The following provisions deserve particular attention.

Identification of the Parties and Their Roles

The agreement should clearly identify the Data Fiduciary and Data Processor. The names of the contracting entities, registered addresses and relevant contact details should be stated accurately. The DPA should also explain which party determines the purpose of processing and which party processes information on behalf of the other. This distinction matters because contractual responsibilities may differ depending on the role performed by each party. Where a processor also provides services for its own independent purposes, the agreement should clearly identify those activities. A processor should not be described as acting solely on instructions if the commercial arrangement gives it independent purposes for particular processing activities.

Description of the Processing Activities

The DPA should clearly describe what the processor is permitted to do with personal data. It should identify the subject matter, purpose and nature of processing. The agreement should also specify the duration of processing and the services for which personal data is being processed. For example, a payroll provider may process employee information to administer salaries and statutory benefits. A customer support platform may process customer names, contact details and communications to provide support. A detailed processing schedule is preferable to vague wording. It gives both parties a practical reference when deciding whether a proposed activity falls within the agreed scope.

Categories of Personal Data

The agreement should explain the categories of personal data involved. Depending on the business, this may include names, contact details, account information, employment information, transaction details, identification information or other data relating to individuals. The DPA should avoid unnecessarily broad descriptions. Defining the information accurately helps the processor understand its responsibilities and enables the Data Fiduciary to assess the security risks associated with the processing. The categories of Data Principals should also be identified where appropriate. These may include customers, employees, users, suppliers or other individuals.

Purpose and Instructions for Processing

The processor should be permitted to process personal data only for defined purposes and in accordance with the Data Fiduciary’s instructions. The DPA should explain how instructions will be issued and how changes will be documented. It should also address what happens if the processor believes an instruction conflicts with applicable law. This provision is especially important for cloud and technology services where automated processing may occur across multiple systems. The agreement should also distinguish between processing performed on the customer’s instructions and processing undertaken by the processor for its own independent purposes.

Confidentiality Obligations

Individuals who can access personal data should be subject to appropriate confidentiality obligations. The DPA should require the processor to limit access to authorised personnel and ensure those personnel understand their confidentiality responsibilities. Confidentiality should continue for an appropriate period after the processing relationship ends where the nature of the information requires continuing protection. The agreement should also cover personnel working for relevant subcontractors where they have access to personal data.

Security Measures

Security should be one of the most detailed parts of a DPA. The DPDP Rules, 2025 specify minimum security safeguards for Data Fiduciaries, including appropriate measures involving encryption, obfuscation, masking or virtual tokens, access controls, logging, monitoring, backups and technical and organisational measures. The Rules also specifically contemplate appropriate contractual provisions between a Data Fiduciary and Data Processor concerning reasonable security safeguards. A DPA should therefore describe the security standards expected from the processor. Depending on the nature of processing, this may include access management, encryption, vulnerability management, security monitoring, incident response, backup arrangements and employee security controls. The security requirements should be proportionate to the nature and risks of the processing.

Personal Data Breach Notification

The DPA should establish a clear process for dealing with a personal data breach. The processor should be required to notify the Data Fiduciary promptly after becoming aware of an incident involving personal data. The agreement should explain what information must be provided and how the processor will assist with investigation, containment and remediation. This is important because the Data Fiduciary may have its own regulatory notification obligations. The processor needs to provide information quickly enough for the Data Fiduciary to assess and fulfil those responsibilities. Under Rule 7 of the DPDP Rules, 2025, a Data Fiduciary must intimate affected Data Principals without delay after becoming aware of a personal data breach. The Rules also prescribe information to be provided to the Data Protection Board, including detailed information within 72 hours, subject to the mechanism provided in the Rules.

Assistance With Data Principal Rights

The DPA should explain how the processor will assist the Data Fiduciary when individuals exercise their rights. The DPDP framework provides rights to Data Principals, including rights concerning access to information, correction and erasure, subject to the applicable provisions and conditions. A processor may hold information required to respond to such requests. The contract should therefore establish how the processor will identify relevant records, provide information and implement instructions from the Data Fiduciary. The parties should also agree on practical response procedures and appropriate timelines.

Appointment of Sub Processors

Many processors rely on other service providers. A cloud platform, for example, may use separate infrastructure, hosting, analytics or security providers. The DPA should address whether sub processors are permitted and how they may be appointed. It should establish whether prior consent or notification is required before a new sub processor is introduced. It should also require appropriate contractual obligations to flow down to relevant sub processors. A current review of DPA structures shows sub processor provisions are commonly included alongside security, breach response and international transfer provisions. The Data Fiduciary should also understand where its information will be processed and which third parties may have access to it.

International Data Transfers

Cross border processing deserves careful consideration, particularly where a processor uses overseas cloud infrastructure or group companies. The DPDP Rules, 2025 provide that personal data processed under the Act may be transferred outside India subject to restrictions or requirements specified by the Central Government concerning making such personal data available to a foreign State or persons or entities under its control. A DPA should therefore identify relevant processing locations and establish responsibilities concerning international transfers. Businesses operating across jurisdictions may also need to consider foreign data protection laws. A DPA should not assume Indian law is the only applicable framework.

Audit and Compliance Rights

The Data Fiduciary should have suitable oversight of the processor. The DPA may provide rights to request information, review relevant compliance documentation or conduct audits where justified by the nature and risk of processing. The objective is not necessarily to give the Data Fiduciary unlimited access to the processor’s systems. Instead, the agreement should create a practical mechanism for verifying compliance while protecting the processor’s confidential information and the security of other customers. The scope and frequency of audits should be proportionate to the processing risk.

Retention, Return and Deletion of Personal Data

The agreement should specify what happens to personal data when the services end. The processor should generally return or delete information in accordance with the Data Fiduciary’s instructions and applicable legal requirements. The DPA should also address backups, archived information and legally required retention. Simply stating that information will be deleted immediately may be unrealistic if copies remain in secure backup systems. The DPDP Rules also contain provisions concerning retention of personal data and processing logs in specified circumstances. Rule 8 requires certain Data Fiduciaries to retain relevant personal data, traffic data and processing logs for at least one year for specified purposes, subject to applicable legal requirements. The contractual retention clause should therefore be aligned with statutory and regulatory requirements.

Liability and Indemnity

A DPA should explain how contractual liability operates when a processor fails to comply with its obligations. The parties may negotiate provisions concerning indemnities, limitations of liability, exclusions and responsibility for losses arising from data protection failures. These provisions should be read alongside the main commercial agreement. A liability clause in the DPA should not unintentionally conflict with the broader agreement. The allocation of contractual risk should also reflect the scale and sensitivity of the processing.

Cooperation With Regulators and Investigations

A processor may need to assist the Data Fiduciary during regulatory enquiries, investigations or legal proceedings. The DPA should explain the level of cooperation expected and how information will be provided. This may include supplying relevant records, explaining processing operations, assisting with incident investigations and supporting responses to regulatory requests where legally permissible. Clear procedures can avoid disputes over responsibilities during an urgent investigation.

What Are the Benefits of a Well Drafted DPA?

A carefully prepared DPA creates clearer accountability between the parties. It helps the Data Fiduciary maintain control over outsourced processing and gives the processor a defined framework for handling personal data. It can also improve vendor management by establishing minimum security requirements, breach response procedures and rules for subcontracting. More importantly, the DPA should work as an operational document. Employees responsible for procurement, privacy, technology and compliance should be able to use it when evaluating whether a vendor’s activities remain within the agreed scope.

Common Mistakes in Data Processing Agreements

One common mistake is using a generic DPA without considering the actual services being provided. A second problem is failing to identify the categories of personal data and Data Principals involved. Broad language can make it difficult to assess security requirements. Another issue is inadequate breach notification wording. If a processor has no clear obligation to notify the Data Fiduciary promptly, the business may struggle to respond to its own regulatory responsibilities. Businesses should also avoid ignoring sub processors and international processing locations. Modern technology services often involve multiple vendors, cloud environments and jurisdictions. Finally, the DPA should be reviewed whenever the nature of processing changes. A contract prepared for a simple hosting arrangement may not adequately address a later use of analytics, artificial intelligence or additional third party services.

How Should Businesses Review Their DPAs?

Businesses should begin by mapping the personal data shared with each processor. They should identify the purpose of processing, categories of individuals, locations of processing, security risks and relevant sub processors. The existing commercial agreement should then be reviewed alongside the DPA. The documents should work together rather than create conflicting obligations. Businesses seeking specialist

data protection legal services

can also obtain a structured review of vendor arrangements, privacy obligations and contractual safeguards. A periodic review is particularly useful when a vendor introduces new services, changes its infrastructure, appoints additional sub processors or begins processing information in another jurisdiction.

When Should a Business Use a DPA?

A DPA is particularly important when an external organisation processes personal data on behalf of a business. Common examples include cloud computing providers, payroll platforms, customer support providers, marketing technology providers, hosting companies, software as a service platforms and outsourced business process providers. The exact contractual structure will depend on the relationship. In some cases, the DPA may be a separate document. In others, it may form part of a master services agreement or another commercial contract. The key requirement is to ensure the contractual arrangement accurately reflects the processing relationship and applicable legal obligations.

Conclusion

A Data Processing Agreement should provide much more than a general promise to protect personal information. It should establish a practical framework for how a Data Processor handles personal data on behalf of a Data Fiduciary. In India, Section 8 of the DPDP Act makes a valid contract important when a Data Fiduciary engages a Data Processor for covered activities. The Data Fiduciary also remains responsible for compliance concerning processing undertaken on its behalf. A well drafted DPA should therefore address the parties and their roles, processing purposes, categories of personal data, instructions, confidentiality, security safeguards, breach response, Data Principal rights, sub processors, international transfers, audits and retention or deletion. Businesses should also remember that a DPA is not a substitute for broader privacy and cybersecurity compliance. It should operate alongside appropriate policies, technical safeguards, vendor assessments and internal procedures. As India’s data protection framework develops, businesses should regularly review their DPAs rather than relying on outdated templates. For complex technology arrangements, specialist technology contract lawyers can help ensure the DPA aligns with the wider commercial agreement, operational requirements and applicable data protection obligations.