Data Protection Clause: Meaning, Sample & Drafting Tips (India)
A data protection clause allocates responsibility for personal data processed under a contract: who decides why and how it is processed, what security applies, how breaches are reported and when data is deleted. In India it should track the Digital Personal Data Protection Act, 2023, which requires a Data Fiduciary to engage a Data Processor only under a valid contract.
Looking for the wider concept? Glossary: DPA (Data Processing Agreement)
How it works under Indian law
Under the Digital Personal Data Protection Act, 2023, a Data Fiduciary (which determines the purpose and means of processing) remains responsible for compliance even where a Data Processor processes data on its behalf, and may engage a processor only under a valid contract (section 8). The clause should make the processor's obligations mirror the fiduciary's statutory duties.
Section 8 also requires reasonable security safeguards, intimation of a personal data breach to the Data Protection Board and to each affected Data Principal, and erasure of personal data once the purpose is served or consent is withdrawn (subject to retention required by law). Section 16 allows the Central Government to restrict transfers to notified countries. The Schedule to the Act provides for penalties of up to INR 250 crore for failure to take reasonable security safeguards.
The DPDP Rules, 2025 phase in most obligations over a transition period, and until then the Information Technology Act, 2000 (section 43A) and the 2011 SPDI Rules continue to matter for sensitive personal data. Sector rules — for example RBI directions for regulated entities and CERT-In's incident reporting directions — may impose shorter reporting timelines that the contract should reflect.
Drafting checklist
- Identify roles: who is the Data Fiduciary and who is the Data Processor for each data set.
- Describe the data, purposes, data principals and retention period in a schedule.
- Specify security safeguards (encryption, access control, logging) in a schedule.
- Set a breach notification timeline short enough for the fiduciary to meet DPDP and sector deadlines.
- Control sub-processors and cross-border transfers.
- Provide for assistance with data principal rights, audits and deletion on exit.
- Align the clause with the liability cap (often a data-breach super-cap).
Sample data protection clause
Two versions: a standard position and an alternative you can offer in negotiation. Replace every [placeholder] before use.
Standard processor clause (DPDP Act)
Standard positionTo the extent [Supplier] processes personal data on behalf of [Customer] under this Agreement, [Customer] is the Data Fiduciary and [Supplier] is the Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). [Supplier] shall: (a) process the personal data only on [Customer]'s documented instructions and for the purposes in Schedule [X]; (b) implement reasonable security safeguards, including those in Schedule [Y], to prevent personal data breach; (c) ensure that its personnel are bound by confidentiality; (d) not engage a sub-processor without [Customer]'s prior written consent and on terms no less protective than this Clause; (e) notify [Customer] without undue delay, and in any event within [24] hours, of becoming aware of a personal data breach, with the information [Customer] needs to meet its own reporting obligations; (f) assist [Customer] in responding to requests from Data Principals and the Data Protection Board; and (g) on termination or on [Customer]'s instruction, delete or return all personal data and certify deletion, save as required by law.
Supplier-favourable version (cost recovery and transfer flexibility)
Supplier-favourable — limits open-ended assistance and allows offshore processing[Supplier] shall provide reasonable assistance under Clause [X](f), and [Customer] shall reimburse [Supplier]'s reasonable costs for assistance exceeding [number] hours in any calendar quarter. [Customer] warrants that it has obtained all consents and given all notices required under the DPDP Act for the processing contemplated by this Agreement. [Supplier] may process personal data outside India, provided that it does not transfer personal data to any country or territory restricted by the Central Government under section 16 of the DPDP Act, and it remains responsible for its sub-processors. Audits shall take place no more than once in any twelve-month period, on [30] days' notice and subject to reasonable confidentiality conditions, unless required by a regulator or following a personal data breach.
Who pushes for what
Typical negotiating positions on each side of the table.
Data Fiduciary / customer
Wants tight instructions, short breach notification, audit rights, consent over sub-processors and uncapped or super-capped liability for data breach.
Data Processor / supplier
Wants a general authorisation for listed sub-processors, cost recovery for assistance, limited audits and the general liability cap.
Common middle ground
Listed sub-processors with notice of changes, 24-72 hour breach notice, annual audit, data-breach super-cap.
Common mistakes
- Copying a GDPR data processing addendum without mapping its terms to DPDP concepts and Indian sector rules.
- No breach timeline — the fiduciary cannot meet its own reporting duties without one.
- Treating both parties as "joint controllers" by default when the relationship is clearly fiduciary-processor.
- Leaving data deletion on exit unaddressed, especially for backups.
Frequently asked questions
Is a data processing agreement mandatory under the DPDP Act?
The DPDP Act allows a Data Fiduciary to engage a Data Processor only under a valid contract. Whether a separate agreement or a clause in the main contract is used, the processing terms must be in writing and agreed.
Who is liable for a breach by a processor?
Under the DPDP Act, the Data Fiduciary remains responsible for compliance, including processing by its processors. The contract is how the fiduciary recovers its loss from the processor, which is why indemnities and caps for data breach are heavily negotiated.
Can personal data be transferred outside India?
The DPDP Act permits transfers except to countries the Central Government restricts by notification. Sector regulators may impose separate localisation requirements, for example for payment data.
Related tools, formats and guides
Build a clause library with approved fallbacks in CaseDocker
Store your approved clause language and pre-agreed fallback positions in CaseDocker's Contract Management module, and use Playbooks to route any deviation to the right approver before the contract goes out for signature.