Vendor and Processor Management Under DPDPA: You Are Accountable for Their Failures

The DPDPA's accountability chain has one direction: up. A Data Fiduciary may engage any Data Processor to process personal data on its behalf — but only under a valid contract, and the fiduciary remains responsible for compliance regardless of any agreement to the contrary (Section 8(2)–8(3)). If your CRM vendor leaks your customer data, the Board's first call is to you.

What your DPAs must now say

A DPDPA-grade Data Processing Agreement should cover, at minimum:

• Processing scope: what data, what purposes, on documented instructions only
• Security safeguards the processor must maintain — with audit/attestation rights
• Breach duties: notify you immediately with enough detail to meet your own 72-hour Board deadline (see the breach playbook)
• Sub-processor control: consent to appointments, flow-down of identical duties
• Rights support: assistance with access, correction and erasure requests within your SLA
• Erasure on exit: certified deletion or return when the engagement or the purpose ends
• Location transparency: where processing happens, so your transfer register stays true

The lifecycle, not just the contract

Onboard with a proportionate due-diligence check — security posture, certifications (ISO 27001, SOC 2), breach history, data locations. Register every vendor in your RoPA with the data categories they touch. Monitor annually or on trigger events (their breach, their acquisition, new sub-processors). Exit deliberately: erasure certificates, access revocation, and a record of both.

The typical Indian mid-market gap

Most companies discover during their first data-mapping exercise that 30–60% of personal-data flows to third parties have no DPA at all — analytics snippets, marketing agencies, that one Excel export a reseller receives weekly. Shadow vendors are unpriced ₹250 crore risk.

Sambandh, Data Adhikaar's vendor agent, maintains the processor register, tracks DPA status and expiry, chases attestations and flags unregistered data flows that Drishti discovers. See the full picture on the platform overview, or benchmark yourself with the readiness assessment.