Can we actually lose an enterprise deal over DPDP?
Why DPDP compliance is now showing up in RFPs, vendor onboarding checklists, and contract clauses — and what non-compliance is costing IT vendors.
When compliance topics come up in a sales conversation, there is a natural instinct to treat them as a legal team problem, not a revenue problem. DPDP is different. Because the Act places compliance obligations on enterprise clients for their entire vendor supply chain, those clients are directly incentivised to push DPDP requirements down to vendors — and to remove vendors who cannot meet those requirements. This is not a hypothetical future concern. It is a present commercial reality for IT vendors selling into enterprise accounts in India.
This post is about understanding exactly how DPDP compliance risk shows up in your sales pipeline — and what you can do to turn it from a threat into a differentiator. If you have already received a DPDP security questionnaire from a client, you are already in the deal-risk zone this post describes.
How DPDP is entering the procurement process
Vendor compliance requirements typically enter the procurement process at one of four stages, each with different implications for deal velocity and deal risk.
Stage 1: RFP qualification criteria
The earliest and most decisive insertion point. Some enterprise clients — particularly large private sector banks, insurance companies, and listed BFSI entities — have begun adding DPDP compliance as a pass/fail criterion in RFPs. The question typically reads something like: "Does your organisation have a documented DPDP compliance programme in place? Please provide a summary." Vendors who respond with "No" or "In progress" may be filtered out before their technical or commercial proposal is even read. This is the stage where DPDP compliance becomes a licence to participate, not a differentiator.
Stage 2: Vendor onboarding assessment
More commonly, DPDP compliance requirements appear at the vendor onboarding stage — after a commercial agreement is in principle reached, but before the contract is executed and the engagement begins. The client's vendor risk team sends a compliance questionnaire, requires completion within a specified window, and withholds contract sign-off until the review is complete. Delays at this stage directly delay revenue recognition. A questionnaire that takes your team three weeks to answer because no one owns it internally is costing you three weeks of revenue on that contract.
Stage 3: Contract clauses
Enterprise legal teams are inserting DPDP-specific clauses into service agreements and MSAs. These include data processing obligations, breach notification timelines (typically 24–48 hours), audit rights, data deletion requirements on termination, and — increasingly — a right for the client to terminate the contract if the vendor is found to be non-compliant following a regulatory audit or incident. Some contracts include representations and warranties that the vendor complies with DPDP at the time of signing, which creates legal exposure if that representation is not actually true.
Stage 4: Annual renewal risk assessment
Even for established vendor relationships, DPDP is entering the renewal process. Clients are conducting annual vendor risk reviews and requiring updated compliance documentation. Vendors who were onboarded before DPDP was a consideration are now being asked to demonstrate compliance retroactively. This is particularly acute for vendors with multi-year contracts that are coming up for renewal in 2025–2027 as the DPDP enforcement deadline approaches.
The deal qualification questions you will face
Based on the questionnaires currently circulating among Indian enterprise clients, here are the compliance questions most likely to qualify or disqualify a vendor:
- "Has your organisation conducted a DPDP applicability assessment?"
- "Do you have a documented data processing register or record of processing activities?"
- "Do you have a designated Data Protection Officer or equivalent contact?"
- "Are you able to sign our Data Processing Agreement with the terms as drafted?"
- "What is your breach notification timeline — how quickly will you inform us of a personal data breach involving our data?"
- "Do you conduct regular security assessments or penetration testing? What is the frequency?"
- "Where is our data stored? If outside India, what transfer mechanism do you rely on?"
- "Have you ever been subject to a DPDP or IT Act investigation or enforcement action?"
A vendor who can answer each of these questions clearly, accurately, and in writing — ideally by referencing existing documentation rather than drafting responses from scratch — is signalling compliance maturity. A vendor who hedges, delays, or gives inconsistent answers across different team members is signalling risk.
What non-compliance is actually costing vendors
The commercial cost of DPDP non-compliance manifests in three ways that do not show up in a legal risk register but absolutely show up in a P&L.
Delayed revenue: Every day a vendor onboarding review is pending because the vendor cannot produce compliance documentation is a day of delayed billing. For a ₹50 lakh annual contract, a four-week delay costs roughly ₹4 lakh in cash flow. Multiply that across five enterprise contracts stalled simultaneously and the cost of non-compliance becomes visible.
Lost deals: The deals you never know you lost are the most expensive. When a vendor is disqualified at the RFP stage because a competitor can demonstrate DPDP compliance and they cannot, the loss does not appear in the CRM as "lost — DPDP compliance." It appears as "no response to RFP" or "not shortlisted." Many IT vendors are losing deals at the qualification stage without knowing that DPDP was the reason.
Contract scope restriction: Enterprise clients are restricting the data they share with non-compliant vendors while compliance is pending review. This can mean reduced contract scope — and reduced billing — until the vendor demonstrates adequate controls. A managed services vendor who cannot demonstrate DPDP compliance may find their client scope limited to non-personal-data workloads, reducing the contract value significantly.
For context on the regulatory exposure that enterprise clients are trying to offload to their vendors, our post on DPDP penalties explains the penalty schedule that Data Fiduciaries face — and why they are so motivated to ensure their vendors are compliant.
The DPDP-ready vendor advantage
There is a mirror image to every risk described above: the vendor who is demonstrably DPDP-ready has a real competitive advantage in the current procurement environment. When two vendors are otherwise comparable on price and capability, the one who arrives with a completed compliance self-assessment, a signed DPA template, a clear breach notification policy, and a named data protection contact will win the compliance review faster — and in some cases will be the only vendor who passes it.
This is not theoretical. The vendors who invested in ISO 27001 certification before it became a common procurement requirement saw exactly this dynamic play out a decade ago. DPDP compliance is on the same trajectory — early adopters have a window to differentiate; late adopters will pay the cost of compliance without the competitive benefit.
What does "DPDP-ready" look like to a procurement team? Our post on what enterprise clients now demand from IT services firms covers this in detail. The minimum bar is lower than most vendors assume, and the evidence required is mostly documentation of practices that most IT firms already follow informally.
The cost of delay
The DPDP enforcement deadline is May 2027. That sounds distant. It is not. Enterprise clients are not waiting for the deadline to begin enforcing compliance requirements through their supply chains. The procurement teams, legal departments, and vendor risk functions of large Indian enterprises are acting now, on the reasonable assumption that they need their vendor base to be compliant before the Data Protection Board begins enforcement.
Every quarter a vendor delays its DPDP compliance programme is a quarter during which it is exposed to the deal qualification risk described in this post. Use the free DPDP Penalty Calculator to understand the financial exposure your clients face — and why they are pushing so hard on vendor compliance right now.
Want to see what DPDP penalties could mean for your business?
Use our free Penalty Calculator to model the financial exposure under the DPDP Act 2023 — and understand why your clients are taking this seriously.
Calculate My Penalty Exposure — FreeFrequently Asked Questions
Are enterprise clients in India actually enforcing DPDP compliance on vendors right now?
Yes — particularly in BFSI, healthcare, and large e-commerce. These sectors face their own regulatory pressure from RBI, IRDAI, and SEBI to ensure vendor compliance with data protection requirements. DPDP questionnaires and DPA requirements are appearing in new vendor onboarding processes and annual renewal cycles. The frequency is increasing as the enforcement deadline of May 2027 approaches.
Does DPDP compliance have to be certified by a third party?
No — the DPDP Act does not require third-party certification for most vendors. A self-assessed compliance programme, documented in writing, is sufficient for most enterprise procurement reviews. Where clients require third-party assurance, they typically ask for existing certifications like ISO 27001 or SOC 2. A dedicated DPDP certification scheme may be introduced by the Data Protection Board eventually, but it does not exist yet.
What is the minimum a vendor needs to demonstrate DPDP compliance to a client?
At minimum: a completed DPDP applicability assessment, a record of what personal data you process and for what purpose, a privacy policy, a Data Processing Agreement template you can sign, a breach notification procedure, and a named point of contact for data protection queries. This foundation can be built in 2–4 weeks with focused effort and does not require external legal counsel for every element.