What Is Mandatory Before Onboarding a Data Processor Under the DPDP Act

Handing customer data to a vendor does not automatically hand over the legal responsibility. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), a company that decides why and how personal data is used (the Data Fiduciary) remains responsible for compliance with the Act when a cloud host, payroll provider, CRM or analytics tool processes data on its behalf (a Data Processor).

That is why the weeks before a vendor goes live matter more than the weeks after. India’s DPDP Act and the Digital Personal Data Protection Rules, 2025 establish a framework for handling digital personal data. However, the provisions are being introduced in phases. As of November 3, 2026, the main provisions relating to Data Fiduciary responsibilities are scheduled to take effect on May 13, 2027.

This guide walks through what needs to be settled before a processor touches a single record, in the order a compliance or procurement team would actually work through it.

Why the fiduciary carries the risk

The two roles are easy to tell apart. The fiduciary sets the purpose and means of processing. The processor handles personal data on the fiduciary’s behalf and according to the agreed instructions.

Section 8(1) of the DPDP Act provides that a Data Fiduciary remains responsible for compliance with the Act in respect of processing carried out by it or on its behalf by a Data Processor, notwithstanding any agreement to the contrary.

A vendor’s mistake does not automatically mean that the company has committed a legal violation in every circumstance. However, a business cannot assume that outsourcing data processing removes its own responsibilities. A data breach at a vendor can expose the company to regulatory consequences, compensation claims where applicable, loss of customer trust and service disruption.

Five things to have in place before onboarding

1. A written processing agreement

Section 8(2) of the DPDP Act provides for a Data Processor to be engaged on behalf of a Data Fiduciary under a valid contract. A written agreement is therefore an important part of vendor onboarding.

A useful agreement covers:

• The exact purpose the vendor may process data for, and nothing beyond the agreed arrangement.
• A promise to act according to the fiduciary’s documented instructions.
• Confidentiality obligations for the vendor’s staff who can access the data.
• Named security measures such as encryption, masking and access control.
• A deadline for telling you about a suspected or confirmed breach. This contractual deadline should allow the fiduciary enough time to meet its own legal reporting obligations.
• Your right to audit or inspect the vendor’s relevant security and compliance practices.
• Approval and notification rules for any sub-vendor.
• What happens to the data when the contract ends: return or deletion, subject to applicable legal retention requirements.

2. Proper due diligence

Check the vendor on four fronts before signing.

Legal: Does it follow applicable laws, have appropriate compliance procedures, and have any relevant history of violations?

Technical: How is data encrypted, where is it stored, and how is the network secured?

Operational: Are staff trained, and is there an incident response plan?

Assurance: Does it hold certifications or independent assurance reports such as ISO 27001 or SOC 2?

Ask plainly whether it has experienced earlier breaches and who owns security inside the company. Certifications can provide useful assurance, but they do not automatically establish compliance with the DPDP Act.

3. Reasonable security safeguards

The DPDP Rules, 2025 describe security safeguards that include measures such as encryption, masking, access controls, monitoring and appropriate security measures.

Write down what reasonable security means for this vendor and the type of data it will handle. This may include encryption, role-based access, multi-factor authentication, masking and activity logs.

The safeguards should be appropriate to the nature of the information and the risks involved.

4. Control over sub-processors

Vendors often rely on other vendors. Require appropriate notification or approval before sub-processors are engaged, ensure relevant data protection duties are reflected in downstream contracts, and keep reviewing the arrangement.

If your cloud provider relies on another company for hosting infrastructure, that provider is also part of your supply-chain risk.

5. A purpose and retention plan

Decide in advance how long each kind of data needs to stay with the vendor and why.

Data type	Purpose	Keep it for
Customer data	Delivering the service	Length of the contract
Employee data	Payroll	As required by law
Marketing data	Campaigns	Until consent is withdrawn

The DPDP Rules also include specific retention requirements for certain personal data and processing logs. For example, Rule 8 provides for the retention of specified personal data and logs for at least one year for certain security-related purposes, subject to the rule’s terms and applicable requirements.

Do not assume that all information can be deleted immediately when a contract ends. Some records may need to be retained under applicable laws.

A practical order of work

1. List what data the vendor will handle and why.
2. Run the due diligence checks above.
3. Review the vendor’s security setup against your own standard.
4. Negotiate and sign the agreement.
5. Address any sub-vendors in writing.
6. Establish retention and deletion procedures.
7. Keep reviewing the arrangement after go-live.

Onboarding is the start of the relationship, not the end of the task. Plan periodic audits, vendor reassessments and incident monitoring. Reviewing each vendor at least once a year is a sensible baseline, and high-risk vendors deserve it more often.

What it looks like in practice

Take a company adopting a SaaS CRM. Without preparation, there is no clear agreement, the security setup is unknown, nothing says when a breach must be reported, and the vendor’s own suppliers are a mystery.

With preparation, the contract sets out safeguards, the controls have been verified, a reporting window is written in, and the use of sub-vendors has been addressed. The software is the same; the exposure is not.

To make this repeatable, keep a central register of vendors with risk scores and audit results, use a pre-approved agreement template, automate alerts where you can, and train the teams who buy tools so they know to involve compliance early.

Common questions

Can the vendor take over the liability?

No. Section 8(1) places responsibility for compliance with the Act on the Data Fiduciary for processing carried out by it or on its behalf. A vendor can have contractual responsibilities, but an agreement cannot simply transfer the fiduciary’s statutory responsibility.

What if a vendor refuses to sign an agreement?

If the required contractual protections cannot be agreed upon, do not proceed with onboarding until the arrangement has been appropriately assessed and resolved.

Do start-ups need to follow this?

Businesses should not assume that their size alone removes applicable data protection responsibilities. The requirements depend on the law, the processing activities and any applicable exemptions.

Can retention be left open-ended?

No. Data should not be kept indefinitely by default once its purpose has been served. Retention must also take account of applicable legal requirements.

Preparing for Responsible Data Processing

Outsourcing the work is allowed; outsourcing the responsibility is not. Sign the agreement, assess the vendor, control its suppliers and establish retention rules before the first record moves.

This article provides general information about India’s Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025. It is not legal advice. Businesses should seek qualified legal guidance about their specific obligations.