How do I check if my vendors are DPDP compliant?
Your vendors' gaps become your liability — here's how to vet them.
Know what each vendor touches
Inventory your vendors and the personal data each one processes — payroll providers, cloud hosts, analytics, support tools, marketing platforms. The ones handling the most sensitive or voluminous data are your priority for diligence.
Ask the right questions
Use a privacy questionnaire: what data, what safeguards, which sub-processors, where data is stored, breach notification timelines, deletion on termination, and certifications like ISO 27001. Score the answers and tier vendors high, medium and low risk.
Contract and re-check
Bind processors with a DPA that flows down your obligations, sets breach timelines, controls sub-processors and requires deletion or return of data. Re-assess high-risk vendors periodically and whenever the scope of what they handle changes.
Frequently asked questions
Am I liable for my vendor's breach?
You remain accountable for personal data your processors handle for you, so a vendor's failure can become your liability. Diligence and a DPA mitigate this.
What should I ask a vendor?
What data they handle, their safeguards, sub-processors, data location, breach notification, deletion practices and certifications.
Do all vendors need a DPA?
Any vendor that processes personal data on your behalf should be bound by a data processing agreement; prioritise the higher-risk ones first.
Score your vendors
Use the Vendor Risk Scorecard to tier vendors and flag who needs a DPA first.
Vendor Risk Scorecard