What should a Data Processing Agreement include under DPDP?
The clauses a DPDP data processing agreement can't skip.
Scope, instructions and security
State exactly what data is processed and why, and bind the processor to act only on your documented instructions. Require defined security safeguards proportionate to the data, and prohibit use of the data for the processor's own purposes.
Sub-processors and breaches
Require your prior permission for sub-processors and flow-down of the same obligations. Set a breach-notification clock back to you that's tight enough to let you meet your own 72-hour duty to the Board, with the information you'll need.
Exit and assistance
On termination, require deletion or return of all personal data and copies. Oblige the processor to help you respond to access, correction and erasure requests, and to support audits or inspections.
Frequently asked questions
Is a DPA legally required under DPDP?
Processing by a processor must be under a valid contract. A DPA is how you set the required terms and demonstrate accountability.
What's the most important DPA clause?
Breach notification timing — it must be quick enough for you to meet your own 72-hour obligation to the Board.
Can a processor use my data for its own purposes?
No. The DPA should restrict the processor to acting on your instructions for the agreed purpose only.
Generate a DPA
Use the DPA Generator to produce a DPDP-aligned data processing agreement for any vendor.
DPA Generator