Guide
Vendor due diligence under DPDP
Under DPDP, your vendors' processing is your responsibility. Due diligence before signing, and again on a schedule, keeps that risk visible.
Short answer
You remain responsible for processing your Data Processors carry out for you (s.8(1)), you may engage them only under a valid contract (s.8(2)), and Rule 6 requires security terms in those contracts. Before onboarding a SaaS or IT vendor, establish its role, where it processes data, its sub-processors, its security safeguards and how quickly it will tell you about a breach. Tier vendors by risk, and reassess on a set cadence and whenever their service changes.
Why DPDP makes vendors your problem
Section 8(1) keeps you responsible for processing by your processors, and s.8(2) requires a valid contract. If a vendor has a breach, you must intimate the Board and each affected Data Principal (s.8(6), Rule 7), and your clock runs from when you become aware.
Vendors you do not know about are the biggest gap. A SaaS tool signed up on a company card may hold customer or employee data with no contract at all, and a breach there is still yours to report.
Questionnaire themes
| Theme | Questions to ask | Why |
|---|---|---|
| Role | Do you process our data only on our instructions, or for your own purposes too? | Processor or fiduciary changes the contract (s.8(2)) |
| Data and purpose | Which personal data do you receive, and what do you use it for? | Purpose limits and access requests (s.11) |
| Location | Where is data stored, processed and accessed, including support and backups? | s.16, Rule 15, sector rules |
| Sub-processors | Who are your sub-processors, where are they, and how do you tell us about changes? | Keeps the chain under contract |
| Security | Do you use encryption, masking or tokens, access control, logging and monitoring, and backups? How long do you keep logs? | Rule 6 |
| Breach | How soon will you tell us after becoming aware, and what will you share? | Rule 7 |
| Erasure | Can you stop processing and erase on our instruction, and confirm it? | s.6(6), s.8(7) |
| Rights support | Can you find, export, correct and delete one person's data on request? | s.11, s.12 |
Tier vendors by risk
| Tier | Typical vendor (sample) | Diligence | Reassess |
|---|---|---|---|
| High | Core database host, payments or KYC provider, HRIS and payroll | Full questionnaire, evidence review, contract covering every clause theme | Every year and on change |
| Medium | CRM, support desk, marketing email tool | Full questionnaire, contract with security and breach terms | Every two years and on change |
| Low | Tools holding only business contact data | Short questionnaire and standard terms | At renewal |
This is a sample scheme. Set tiers by the volume of personal data, whether it includes children's or financial data, and whether the data leaves India. Re-tier a vendor when it starts receiving new kinds of data or moves processing abroad.
Steps to run due diligence
Run these steps before signing any new vendor. For existing vendors, start with the reassessment step and work through them by tier, high first.
- 01Find every vendor
Combine procurement, finance and single sign-on records with a discovery scan, so unknown SaaS tools show up.
- 02Screen for personal data
Set aside vendors that never touch personal data, and keep the rest.
- 03Tier
Assign a tier using the sample scheme or your own.
- 04Send the questionnaire
Ask the questions for the tier, and ask for evidence behind high-tier answers.
- 05Decide
Approve, approve with conditions, or reject, and record the reason.
- 06Contract
Sign a processor contract using the processor contract checklist.
- 07Reassess
Repeat on the tier's cadence, and whenever the vendor changes location, sub-processors or service.
Due diligence checklist
- Vendor list reconciled with finance and single sign-on
- Role confirmed: processor or fiduciary
- Locations and sub-processors recorded
- Rule 6 security answers reviewed
- Commitment to breach notice without delay
- Erasure and rights support confirmed
- Contract signed before data flows
- Next review date set
How TruePrivacy helps
Vendors and processors keeps vendor records with risk levels, sends assessments through a vendor portal link, and offers question templates, including one asking processors to report breaches without delay. Contracts (DPAs) are tracked alongside.
System discovery in data discovery lists the systems your organisation uses, each marked detected, reviewed or connected, so shadow SaaS becomes visible. Cross-border transfers warns when a vendor matches a country on your restriction list. Related template: the processor addendum.
Do we need to assess every vendor under DPDP?
Every vendor that processes personal data for you, because you remain responsible for its processing (s.8(1)). Scale the depth of review to the risk.
How often should vendors be reassessed?
Set a cadence by tier, such as yearly for high-risk vendors, and reassess whenever a vendor changes location, sub-processors or service.
What breach notice should we require from vendors?
Notice without delay after the vendor becomes aware, because your Rule 7 duties run from when you become aware.
Is a vendor questionnaire enough?
No. You also need a valid contract with security terms (s.8(2), Rule 6).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin