What belongs in a practical data processing agreement

A processing agreement should answer the questions that become urgent when something changes. Who may instruct the supplier? What information must the supplier provide after an incident? How does an erasure decision reach subcontractors? What remains when the contract ends? A document that never answers those questions may be difficult to use even if it contains pages of legal language.

As of 22 October 2026, the main DPDP business obligations are scheduled for 13 May 2027 under the commencement notification. The suggested clauses below are drafting topics for that phase and for sound supplier management. They are not a claim that the DPDP Act reproduces a foreign statute’s clause list.

Establish the role and instructed work

Section 8(2) of the Act addresses engaging a Data Processor for processing on the fiduciary’s behalf in activities related to offering goods or services to Data Principals under a valid contract. Section 8(1) retains fiduciary accountability for processing undertaken on its behalf.

Begin by describing the service, purposes, categories of information and affected people. Identify the authorised instruction route and what the supplier must do if an instruction is unclear or appears inconsistent with the agreement or applicable law.

A hypothetical retailer using a fulfilment provider should specify the order and delivery information the provider receives. If the provider also wants to use customer details for its own advertising, that is a separate role and purpose question, not a minor operational instruction.

Turn safeguards into shared responsibilities

The future Rule 6 includes appropriate contractual provisions concerning security safeguards where a processor is involved. The contract should connect those safeguards with the actual service and clarify which party configures and operates each material control.

Address access, staff confidentiality, relevant monitoring, continuity and protection of records in a way the parties can verify. Avoid a schedule that promises every possible control regardless of relevance or capability. An inaccurate commitment can conceal the real gaps.

Define the evidence available to the customer, such as relevant assurance reports, targeted information or an agreed review process. The degree of assurance should reflect the service and risk. An unlimited audit clause that nobody can exercise is not necessarily more useful than a workable, appropriately scoped mechanism.

Make incident cooperation fast enough to matter

Specify the supplier contact, notification channel, initial information and continuing cooperation. Distinguish prompt initial notice from a later detailed investigation. The customer needs enough information to assess its own obligations without waiting for a final root-cause report.

The future Rule 7 process includes information without delay and a separate detailed Board update. Existing CERT-In Directions impose six-hour reporting for specified incidents affecting covered entities. Contractual commitments should support the applicable routes rather than assume one universal seventy-two-hour notice period.

Record who preserves relevant evidence and how corrections to early information will be communicated. The agreement should support a coordinated response while allowing each party to fulfil its own applicable duties.

Cover requests, downstream processing and change

Describe how the supplier assists with locating, correcting, restricting where appropriate and erasing relevant records. Include the systems and formats involved, expected operational response and any limitations that require a customer decision.

Identify the arrangement for subprocessors and material changes. The business should know which downstream services are involved, what responsibilities flow to them and how it can assess a significant change. Do not present a particular approval model as universally mandated unless a relevant law or contract requires it.

For data movement, require information sufficient to assess applicable restrictions, including processing locations and relevant remote access. A single storage-region field may not describe the whole arrangement.

Define retention and exit honestly

The final Rule 8(3) requires personal data, associated traffic data and processing logs to be retained for at least one year from processing for Seventh Schedule purposes, then erased unless other law or a Government notification requires further retention. Other legal requirements may affect particular records. The agreement should reconcile those requirements with instructions and erasure obligations, not promise unconditional immediate deletion of everything.

At exit, define export, return, deletion, retained exceptions, backups and evidence of completion. State who pays for and performs any necessary transition work. A supplier’s end-of-service process should be understandable before the customer depends on it.

Finally, test the draft against one incident, one individual request and one termination. If the parties cannot identify the next action, owner and evidence in each scenario, revise the operational provisions. A practical agreement connects legal responsibility with steps the people running the service can actually execute.