Data Processors Under the DPDP Act: What Your Vendors Must Do

The short answer

Under India’s DPDP Act, you stay responsible for personal data your vendors handle for you. Your cloud host, email tool, CRM, payment gateway and analytics provider are usually Data Processors. You can only use them under a valid contract, and you must make sure they protect and erase data as the Act requires.

Who is a Data Processor?

Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. The Data Fiduciary is the business that decides why and how the data is processed: that is you.

Common Data Processors:

• cloud hosting and databases,
• email and SMS providers,
• CRM and support desks,
• payment gateways and logistics partners,
• analytics and marketing tools.

What the Act requires of you

Section 8 puts these duties on the Data Fiduciary:

• Section 8(1): you are responsible for compliance for any processing done by you or on your behalf by a Data Processor.
• Section 8(2): you may engage a Data Processor only under a valid contract.
• Section 8(5): you must take reasonable security safeguards to prevent a breach, including for processing done by your processors. Failing this carries a cap of up to ₹250 crore, the highest in the Schedule. Read Section 8(5) explained.
• Section 8(6): you must notify the Board and affected users of a personal data breach, even if it happened at a vendor. See breach notification.
• Section 8(7): when consent is withdrawn or the purpose is served, you must erase the data and cause your processors to erase it. See data erasure.

What to put in your vendor contracts

The Act requires a valid contract but does not list clauses. A practical contract covers:

1. Purpose limits: the vendor processes data only on your instructions.
2. Security: encryption, access controls and logging that match your own safeguards.
3. Breach reporting: the vendor tells you fast enough for you to meet your own duty to report.
4. Erasure: the vendor deletes data when you ask and confirms it.
5. Sub-processors: the vendor tells you before using others.
6. Audit rights: you can check compliance.
7. Location: where the data is stored, given the cross-border transfer rules.

A simple vendor review

• List every vendor that touches personal data.
• Record what data each one gets and why.
• Check each has a signed contract with the points above.
• Remove vendors you no longer use, and confirm they deleted your data.
• Review the list every year.

Your consent tool is a processor too

Your consent platform processes data on your behalf. Check where it stores records and whether you can prove each consent. ConsentPlix stores pseudonymous consent records in AWS Mumbai (ap-south-1) and signs each one, so you can show the Board exactly what a user agreed to. Learn more on our trust infrastructure page.

Related: how to handle a deletion request and the DPDP checklist.

Checked against Act No. 22 of 2023, as of October 2026.