Working with Data Processors under the DPDP Act

You stay responsible

Section 8(1) says a Data Fiduciary is responsible for complying with the Act in respect of any processing undertaken by it or on its behalf by a Data Processor. This holds whatever your contract says. If a collection agency working for a lender mishandles borrower data, the lender answers to the Board.

A valid contract is required

Section 8(2) allows a Data Fiduciary to engage, appoint, use or otherwise involve a Data Processor to process personal data only under a valid contract, and only for activities related to offering goods or services to Data Principals. Informal arrangements, such as a freelancer handling customer lists over email with no agreement, do not meet this.

What to put in the contract

The Act does not prescribe contract clauses. The duties it puts on you suggest the terms a processor contract should carry.

• Process only on your documented instructions and for the purposes you set
• Take reasonable security safeguards, as the Rules expect your contracts to provide
• Tell you promptly of any personal data breach, with the facts you need for your own notices
• Erase personal data when you ask, or when the contract ends, and confirm it in writing
• Use sub-processors only with your approval and on the same terms
• Help you respond to Data Principals' requests and to the Board

Due diligence and records

Before onboarding, check what data the processor will receive, where it will be processed, what security measures it runs and which sub-processors it uses. Review high risk vendors at least yearly and after any incident.

A hospital chain might rank its vendors by the data they touch: the diagnostics partner and the hospital information system vendor first, the canteen supplier last. The deepest reviews go where patient data goes.

When the processor has a breach

The breach intimation duty sits with you as the Data Fiduciary. Your 72 hour window for the detailed report to the Board runs from when you become aware, so a processor that takes four days to tell you puts you in a difficult position. Set a short notification period in the contract and test that the contact details work.

How TrustOS helps

TrustOS keeps a register of processors with the data categories, purposes, locations and sub-processors for each, links each one to its contract and assessment, and reminds owners when reviews fall due. Erasure and breach workflows reach processors through the same records.

TrustOS does not draft or approve your contracts and does not decide whether a vendor's controls are adequate. Those calls stay with your legal and security teams, and TrustOS does not replace legal advice.