Section 8
Processor contracts under DPDP
You can use a Data Processor only under a valid contract, and you remain responsible for what it does. This checklist covers what that contract should say.
Short answer
Under s.8(2) you may engage a Data Processor only under a valid contract, and under s.8(1) you remain responsible for processing it carries out on your behalf. Rule 6 requires your contracts with processors to include terms for reasonable security safeguards. Build each contract around your instructions, security, breach notice to you without delay, stopping processing and erasing data on your instruction (s.6(6), s.8(7)), sub-processor approval and audit rights.
What the law requires of you
- You are responsible for processing by your processors (s.8(1)).
- You may engage a processor only under a valid contract (s.8(2)).
- Your contracts with processors must include security safeguard terms (Rule 6).
- When consent is withdrawn, you must have processors stop processing within a reasonable time (s.6(6)).
- When consent is withdrawn or the purpose is no longer served, you must make processors erase the data, unless a law requires retention (s.8(7)).
- You must intimate the Board and each affected Data Principal of a breach, including one at a processor (s.8(6), Rule 7).
- On an access request, you must be able to name the processors that received the person's data (s.11).
Clause themes to include
| Clause | What it should say | Why |
|---|---|---|
| Instructions | The processor processes only on your documented instructions and for your purposes | You stay responsible (s.8(1)) |
| Security | The Rule 6 measures: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; backups; one-year retention of logs | Rule 6 requires security terms in processor contracts |
| Breach notice | Notice to you without delay after becoming aware, with the facts you need for the Board's detailed report | Your Rule 7 clock runs from when you become aware |
| Withdrawal and erasure | Stop processing and erase on your instruction, and confirm in writing | s.6(6), s.8(7) |
| Sub-processors | No new sub-processor without notice and your approval; the same terms flow down | Keeps the whole chain under contract (s.8(2)) |
| Location and transfers | Where data is processed and stored; no transfer to a country the government restricts | s.16, Rule 15 |
| Rights support | Help you answer access, correction and erasure requests within your target | s.11, s.12 |
| Audit and information | Answer questionnaires, provide evidence and allow audits on notice | Evidence for your accountability and, for SDFs, the Rule 13 audit |
| End of contract | Return or erase data and confirm, subject to legal retention | s.8(7) |
Steps to put contracts in place
- 01List your processors
Pull vendors from procurement, finance and single sign-on, and keep those that touch personal data.
- 02Confirm the role
Decide whether each vendor processes only on your behalf (a processor) or decides purposes itself (a fiduciary in its own right). The contract differs.
- 03Review existing terms
Compare each contract with the clause themes above and note the gaps. Vendor due diligence covers the questions to ask first.
- 04Issue an addendum
Send a DPDP processor addendum to cover the gaps, starting with the vendors that hold the most personal data.
- 05Negotiate and sign
Hold firm on security, breach notice and erasure, because they support your own legal duties.
- 06Track and review
Record the signing date and renewal, and reassess the vendor each year or when its service changes.
Flow-down: breach, audit and sub-processors
Your Rule 7 duties run from the moment you become aware of a breach, so a processor that waits a week to tell you leaves you little time. Ask for notice without delay and name a contact on both sides.
Sub-processors should sign terms at least as strict as yours. Ask for the current list and for notice before changes, so you can object.
Contract checklist
- Valid contract in place before any personal data is shared (s.8(2))
- Rule 6 security terms included
- Breach notice to you without delay
- Stop and erase on instruction (s.6(6), s.8(7))
- Sub-processor list and approval right
- Processing locations listed
- Support for rights requests
- Audit and evidence rights
- Exit: return or erase, with confirmation
Sector regulators may set their own outsourcing or data terms. Check your regulator's directions alongside DPDP, and have counsel review the final addendum.
How TruePrivacy helps
Vendors and processors keeps vendor records with risk levels and tracks contracts (DPAs). Assessments go to vendors through a portal link, using question templates, including one asking processors to report breaches without delay.
Cross-border transfers warns when a vendor's location matches a country on your restriction list, and system discovery in data discovery shows SaaS tools nobody contracted for. Related template: the processor addendum.
Is a contract with a Data Processor mandatory under DPDP?
Yes. Section 8(2) lets a Data Fiduciary engage a processor only under a valid contract.
Who is responsible if a processor has a breach?
The Data Fiduciary remains responsible for processing by its processors (s.8(1)), and must intimate the Board and each affected Data Principal (s.8(6), Rule 7).
What security terms must the contract contain?
Rule 6 requires contracts with processors to include reasonable security safeguards. Use the Rule 6 list as the baseline: encryption or masking, access control, logging and monitoring, backups and log retention.
Does a processor have to erase data when consent is withdrawn?
Yes. Section 8(7) requires you to make your processors erase it when consent is withdrawn or the purpose is no longer served, unless a law requires retention.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin