UPDATE - NOVEMBER 2025: The Digital Personal Data Protection Rules, 2025 (DPDP Rules) were notified by MeitY on 14 November 2025 and are now in force on a phased timeline: immediate effect from November 2025 for foundational provisions; Consent Manager Framework from November 2026; full compliance obligations (notices, security safeguards, breach notification, children's data protections, cross-border transfer rules) from May 2027. The Data Protection Board of India has been established. The references in this article to rules being finalised should be read as updated accordingly - the Rules are now notified and businesses should be building their DPDP compliance programme actively. India's Digital Personal Data Protection Act 2023 (DPDP Act) requires businesses to include specific data protection provisions in any contract under which a third party processes personal data on their behalf. This applies to vendor agreements, SaaS contracts, IT services agreements, cloud hosting contracts, and any other commercial arrangement where personal data flows to a third-party processor.
Why Standard Contracts Need Updating For Dpdp
Most existing vendor agreements and SaaS contracts in India were drafted before the DPDP Act came into force. They do not contain the specific data processing obligations the Act requires. Using contracts that predate the DPDP Act for new engagements involving personal data is a compliance gap that regulators can penalise. The DPDP Act creates financial penalties of up to Rs.250 crore for data fiduciaries who fail to ensure that their data processors handle personal data in compliance with the Act. The contractual mechanism through which data fiduciaries enforce this compliance is the DPA - the data protection clauses in their vendor and SaaS contracts. THE SEVEN DPDP CLAUSES EVERY VENDOR AND SaaS CONTRACT NEEDS
Clause 1: Purpose Limitation
"The Vendor/Service Provider shall process Personal Data only for the purpose of providing the services described in this Agreement and strictly in accordance with the written instructions of the Client. The Vendor shall not process Personal Data for any other purpose, including for the Vendor's own commercial purposes, marketing, or analytics, without the Client's prior written consent." Why it matters: Prevents the vendor from using your customer or employee data for their own benefit - including training AI models, building competitive intelligence, or reselling data insights.
Clause 2: Security Obligations
"The Vendor shall implement and maintain appropriate technical and organisational security measures to protect Personal Data against accidental or unauthorised destruction, loss, alteration, disclosure, or access. Such measures shall include at minimum: (a) encryption of Personal Data at rest and in transit using industry-standard protocols; (b) access controls limiting Personal Data access to authorised personnel on a need-to-know basis; (c) regular security vulnerability assessments; and (d) a documented information security policy." Why it matters: The DPDP Act requires data fiduciaries to ensure their processors implement reasonable security safeguards. Specifying the minimum security requirements in the contract creates an enforceable standard.
Clause 3: Personal Data Breach Notification
"The Vendor shall notify the Client of any Personal Data Breach as soon as reasonably practicable and in any event within [48/72] hours of becoming aware of the breach. The notification shall include: (a) the nature of the breach; (b) the categories and approximate number of Personal Data records affected; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach." Why it matters: The DPDP Act requires data fiduciaries to notify the Data Protection Board of India of significant breaches. A 48-72 hour notification obligation from the processor to the data fiduciary gives the data fiduciary enough time to assess and comply with its own notification obligation.
Clause 4: Sub-Processor Restrictions
"The Vendor shall not engage any sub-processor to process Personal Data without the Client's prior written consent. The Vendor shall impose on all sub-processors data protection obligations equivalent to those in this Agreement. The Vendor shall remain liable to the Client for the acts and omissions of its sub-processors as if the acts and omissions were the Vendor's own." Why it matters: Many SaaS vendors use sub-processors (cloud infrastructure providers, analytics tools, customer support software). This clause ensures your data is protected throughout the chain, not just at the top level.
Clause 5: Data Principal Rights Assistance
"The Vendor shall, at the Client's request and at no additional charge, assist the Client in responding to requests from Data Principals exercising their rights under the DPDP Act - including the right to access, correct, erase, or obtain information about their Personal Data held by the Vendor." Why it matters: When your customers or employees exercise their rights under the DPDP Act (e.g., requesting deletion of their data), you need your vendors to cooperate in fulfilling those requests promptly. Without this clause, vendors may resist or charge for compliance assistance.
Clause 6: Cross-Border Transfer Restrictions
"The Vendor shall not transfer Personal Data outside India except to countries or territories that the Central Government has not restricted under Section 16 of the DPDP Act, or as otherwise expressly authorised by the Client in writing. The Vendor shall promptly notify the Client if any Central Government restriction on cross-border transfer affects the services provided under this Agreement." Why it matters: Section 16 of the DPDP Act empowers the Central Government to restrict data transfers to certain countries. This clause ensures the vendor actively monitors and complies with these restrictions - and notifies you if their infrastructure needs to change.
Clause 7: Data Return And Deletion On Termination
"On expiry or termination of this Agreement, the Vendor shall, at the Client's election, either: (a) return to the Client all Personal Data in a portable, machine-readable format within [30] days; or (b) securely delete all Personal Data and certify the deletion in writing within [30] days. The Vendor shall retain no copies of Personal Data except to the extent required by applicable law, and shall notify the Client of any such retention." Why it matters: Ensures your customer and employee data does not persist with the vendor after you stop using their services. The certification of deletion gives you documentary evidence of compliance.
When to obtain a review
A review is especially useful when…
- — You are about to sign, send, rely on or respond to this document.
- — The draft was copied from an old template or another state.
- — There is money, property, business control, statutory deadline or reputation risk involved.
- — You need Surat/Gujarat-specific drafting, review or negotiation support.
Legal information notice
This article is general legal information for India and Gujarat. It is not a substitute for advice on your specific facts, documents, limitation period, stamp duty position or court strategy.