Data Processing Agreement (DPDP Act) Template (India) — Free Format
A data processing agreement (DPA) sets the rules a vendor must follow when processing personal data on your behalf under India's Digital Personal Data Protection Act, 2023: purpose limits, security safeguards, breach notification, sub-processors, deletion and audit rights.
Stamp, registration and e-sign at a glance
The three things to settle before anyone signs this agreement in India.
Payable under the stamp law of the state where it is signed; rates vary by state. Unstamped, it cannot be used as evidence until duty and penalty are paid. A DPA attached as a schedule to a stamped main agreement may not need separate duty; check with your advocate.
Check your state's rateRegistration is not required.
This agreement can be signed electronically with Aadhaar eSign or a DSC under the Information Technology Act, 2000. Electronic signatures listed in the Act's Second Schedule carry a presumption of reliability.
What cannot be e-signedWhat is a Data Processing Agreement?
Under the DPDP Act, the data fiduciary that decides why and how personal data is processed stays responsible for compliance, even when a data processor does the processing. The Act allows fiduciaries to engage processors only under a valid contract — a DPA is that contract.
When to use it
- Engaging a payroll, CRM, marketing, cloud or call-centre vendor that handles personal data
- Updating existing vendor contracts for DPDP compliance
- Responding to a customer's request for DPDP processor commitments
Key clauses checklist
Make sure your draft covers each of these. Linked clauses open a sample wording with drafting tips.
- Scope, purpose and instructions Sample clause
- Security safeguards
- Personal data breach notification
- Sub-processors
- Deletion and return of data
- Audit and cooperation
- Indemnity Sample clause
Indian law notes
Fiduciary remains responsible
Section 8 of the DPDP Act makes the data fiduciary responsible for compliance, including for processing by its processors, and requires reasonable security safeguards to prevent personal data breaches.
Breach notification
The fiduciary must notify the Data Protection Board and affected data principals of a personal data breach in the manner prescribed by the DPDP Rules. Processors should notify the fiduciary quickly enough for it to meet those obligations.
Penalties
The Act provides for penalties of up to Rs. 250 crore for failure to take reasonable security safeguards. A DPA does not shift that liability, but it gives the fiduciary contractual remedies against the processor.
DATA PROCESSING AGREEMENT
This Data Processing Agreement ("DPA") is made on [Date] between [Company Name], [address] (the "Data Fiduciary") and [Vendor Name], [address] (the "Data Processor"), and forms part of the [main agreement] dated [Date] (the "Main Agreement").
1. DEFINITIONS
Terms such as "personal data", "processing", "data principal" and "personal data breach" have the meanings given in the Digital Personal Data Protection Act, 2023 and the rules under it (together, "DPDP Law").
2. SCOPE
The Data Processor shall process the personal data described in Schedule 1 only to provide the services under the Main Agreement and only on the Data Fiduciary's documented instructions, including for any transfer outside India.
3. CONFIDENTIALITY OF PERSONNEL
The Data Processor shall ensure that its personnel who access the personal data are bound by confidentiality obligations and are trained on data protection.
4. SECURITY SAFEGUARDS
The Data Processor shall implement reasonable technical and organisational security safeguards, including those in Schedule 2 (such as encryption, access controls, logging and backups), to prevent personal data breaches.
5. PERSONAL DATA BREACH
The Data Processor shall notify the Data Fiduciary without undue delay, and in any case within [24] hours, of becoming aware of a personal data breach, with the details reasonably needed for the Data Fiduciary to notify the Data Protection Board and affected data principals, and shall assist in containment and remediation.
6. SUB-PROCESSORS
The Data Processor shall not engage a sub-processor without the Data Fiduciary's prior written approval, shall impose obligations no less protective than this DPA on each sub-processor, and remains liable for their acts. Approved sub-processors are listed in Schedule 3.
7. DATA PRINCIPAL RIGHTS
The Data Processor shall promptly assist the Data Fiduciary in responding to requests from data principals for access, correction, erasure and grievance redressal, and shall forward any such request it receives directly.
8. RETENTION AND DELETION
On completion of the services, or on the Data Fiduciary's instruction, the Data Processor shall delete or return the personal data and delete existing copies, unless retention is required by law, and certify deletion in writing.
9. AUDIT
The Data Processor shall make available information needed to demonstrate compliance with this DPA and allow audits by the Data Fiduciary or its appointed auditor on reasonable notice, not more than once a year unless following a breach.
10. INDEMNITY AND LIABILITY
The Data Processor shall indemnify the Data Fiduciary against losses, penalties and claims arising from its breach of this DPA or DPDP Law. [This indemnity is / is not] subject to the limitation of liability in the Main Agreement.
11. PRECEDENCE
If this DPA conflicts with the Main Agreement on the processing of personal data, this DPA prevails.
Schedule 1 – Categories of data principals, personal data, purposes and duration
Schedule 2 – Security safeguards
Schedule 3 – Approved sub-processors
For the Data Fiduciary: ____________ For the Data Processor: ____________ Replace every [placeholder] and delete options that do not apply.
How to execute it
From blank template to a signed, stamped and stored contract.
List the personal data, purposes and retention periods in Schedule 1.
Agree security safeguards and a breach notification window.
Approve the sub-processor list.
Sign the DPA as a schedule to the main agreement.
Review processors annually and record evidence of compliance.
Frequently asked questions
Is a data processing agreement mandatory under the DPDP Act?
The Act allows a data fiduciary to engage a processor only under a valid contract, so a written agreement covering processing is effectively required.
Who is liable for a breach at a vendor?
The data fiduciary remains responsible to the Board and data principals. A DPA lets the fiduciary recover losses from the processor contractually.
How quickly must a processor report a breach?
The Act does not fix a processor deadline; contracts commonly require notice within 24 to 72 hours so the fiduciary can meet its own reporting duties.
Related templates
Stop emailing Word files around
Turn this format into an approved template, collect approvals, buy e-stamp paper, send it for Aadhaar eSign and get reminded before it renews.