DPDP by sector
Your clients carry the duty. They will pass it to you in the contract.
Under the Act, the data fiduciary stays responsible for processing done on its behalf. So a client that uses your software or your engineers will want proof you protect its data, and a contract that lets it meet its own duties. This guide covers both sides: what you sign as a data processor, and what you owe as a fiduciary for your own users and staff.
Back to DPDP services01 · Two roles
Most providers hold both roles at once
Processor for client data, fiduciary for your own.
Processor
Client data in your platform
- You process on the client's instructions
- The client's notice and consent cover the data
- Your duties arrive mainly through the contract
- The client answers rights requests; you help
Fiduciary
Your own users, leads and staff
- You decide purpose and means
- You owe notice, consent or a legitimate use
- You answer rights requests and grievances
- You intimate breaches to the Board and people affected
Product analytics on client data is the grey zone. If you use it for your own purposes, you may be a fiduciary for that use.
Section 8(1) makes the fiduciary responsible for processing done by its processors, whatever the agreement says. Section 8(2) lets it engage a processor only under a valid contract. Section 8(5) extends its safeguard duty to processing its processors do. That is why the questions come to you.
Offshore delivery work
Section 17(1)(d) lifts most of the Act's duties when a person in India processes data of people outside India under a contract with someone outside India. The duty to stay responsible and the security safeguards duty still apply. Clients abroad will also bring their own law into the contract.
02 · Contract checklist
What a processor agreement should cover
An illustrative list in our own words. Counsel drafts the clauses.
- Instructions. You process only for the client's stated purposes and on its documented instructions.
- Security. The safeguards you keep, described plainly, with a right to see evidence.
- Breach notice. How fast you tell the client, and what you tell them, so it can meet its own intimation duty.
- Subprocessors. A current list, advance notice of changes, and the same terms passed down.
- Location. Where data is stored and accessed, and how a change is agreed.
- Rights support. How you help find, correct or erase a person's data on request.
- Erasure at end. Return or delete on exit or on instruction, with confirmation, as section 8(7)(b) expects of the client.
- Audit and evidence. What reports you share and when the client may test further.
- Staff. Confidentiality duties and access limited to people who need it.
03 · Subprocessors
Keep a subprocessor list a client can read
Clients need it to answer access requests that name recipients.
A person can ask a fiduciary for the identities of the fiduciaries and processors it shared their data with. If your platform relies on a cloud host, an email service and a support tool, a careful client will want those names too. A public or on-request list saves a round of questions each time.
- Name of each subprocessor and the service it provides
- The client data it can reach
- The country where it stores or accesses data
- The date it was added, and how clients were told
- A list that lags the stack. Engineers add a logging or AI service and nobody updates the list.
- Group companies left off. An affiliate that runs support from another country is a subprocessor too.
- No flow-down. Your terms with the client promise more than your terms with your own vendors.
05 · What clients ask
The questions in a DPDP vendor review
And the evidence that closes each one.
| What the client will ask | Evidence that answers it |
|---|---|
| What personal data of ours do you hold, and where? | A data flow diagram and hosting regions per service |
| Who else can reach it? | The subprocessor list and access control policy |
| How do you protect it? | A SOC 2 Type 2 report or ISO 27001 certificate with its scope |
| How fast will you tell us about a breach? | The contract term and your incident procedure |
| Can you delete our data on request and at exit? | Deletion procedure and a sample confirmation |
| Do you use our data for your own purposes? | A written statement, matched to your own privacy notice |
| Do you send data outside India? | A transfer list by country and service |
A SOC 2 report from a licensed CPA firm, or an ISO 27001 certificate from an accredited body, answers the security questions in one document, as long as its scope covers the service the client buys. Neither covers privacy duties such as notice or erasure in full, so keep a short DPDP addendum to go with it.
Sources: the Digital Personal Data Protection Act, 2023 (sections 2, 8, 11 and 17). The Digital Personal Data Protection Rules, 2025 should be checked for any processor-related detail they set.
Questions from SaaS and IT providers
Does the DPDP Act put duties directly on processors?
Few directly. Most reach you through the client's contract.
The Act places most duties on the fiduciary and makes it responsible for its processors. Expect clients to pass their duties to you in the contract, and expect the Board to look at the fiduciary first.
We already sign GDPR data processing agreements. Can we reuse them?
Mostly, with Indian terms checked.
The structure carries over: instructions, security, subprocessors, deletion, audit. Check breach-notice timing against your client's DPDP intimation duty and the CERT-In reporting window, and check the transfer clause against India's own rules.
Is a SOC 2 report enough for an Indian client's review?
It covers security well. It does not cover privacy duties alone.
A Type 2 report shows your controls worked over a period. Clients will still ask about subprocessors, location, deletion and your own use of their data. Answer those in a short addendum.
We provide engineers who work inside the client's systems. Are we a processor?
Usually, for the data your people handle.
Staff augmentation still means your people process the client's personal data on its behalf. The contract should cover confidentiality, access, security rules and return of data when they leave.
Answer the vendor review before it arrives.
A DPDP readiness assessment for a provider sets out both roles, the evidence pack and the contract gaps. Counsel should confirm how the law applies to your contracts.