Section 8(2) · Rule 6
Vendors and processors under DPDP
You stay responsible for what your processors do with personal data. TruePrivacy keeps each vendor's risk, answers and contract in one record.
Sample workspace
Processors
- Example KYC ServicesHigh risk
- Example Cloud HostingDPA on file
- Example MailerNo DPA yet
- Security termsRule 6
Example KYC Services
- Assessment sent through vendor portal link
- Answers received
- Review answers and confirm risk level
Short answer
Under s.8(1) and s.8(2) of the DPDP Act, a Data Fiduciary is responsible for processing by its Data Processors and may engage them only under a valid contract. Rule 6 asks for security terms in those contracts, and s.8(7) asks you to make processors erase personal data when it must be erased. TruePrivacy keeps vendor records with risk levels, sends assessments through a vendor portal link and tracks contracts (DPAs).
What vendor management does
A Data Processor is any person who processes personal data on behalf of a Data Fiduciary. Under s.8(1) their processing is your responsibility, so you need to know who they are, what they hold and what they have agreed to.
One record per vendor, with a risk level.
Send assessments to vendors through a vendor portal link.
Start from question templates, including one that asks processors to report breaches without delay.
Track the data processing agreement for each vendor.
If a vendor's country is on your transfer restriction list, TruePrivacy warns you.
How a processor review runs
- 01List your processors
Record each vendor that processes personal data on your behalf, and set a risk level. Start with the processors that hold the most personal data or reach your most sensitive systems.
- 02Assess them
Send a questionnaire built from a template through the vendor portal link.
- 03Tie it to the contract
Track the DPA, including the security terms Rule 6 asks for. The processor addendum template can help you draft one.
- 04Review and act
Read the answers, update the risk level and follow up where a vendor falls short. When consent is withdrawn or data must be erased, tell the processor and keep evidence that you did (s.6(6), s.8(7)).
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Be responsible for processing by your Data Processors | s.8(1) | Vendor records with risk levels and assessments |
| Engage processors only under a valid contract | s.8(2) | Contract (DPA) tracking per vendor |
| Security terms in contracts with Data Processors | Rule 6 | DPA tracking, and assessments through the vendor portal |
| Intimate a breach without delay | s.8(6), Rule 7 | A question template asking processors to report breaches without delay |
| Make processors erase, and stop processing after withdrawal | s.8(7), s.6(6) | A vendor list to work from when erasure or withdrawal must reach processors |
What assessments cannot prove
Assessment answers are the vendor's own statements. Weigh them with the contract and your own checks, and have counsel review DPA terms. See the processor contracts guide.
If you process data in India about people outside India under a contract with a person outside India, s.17(1)(d) says Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 do not apply to that processing. See BPO and GCC and check with counsel.
Works with
A country restriction list you keep, with warnings on vendor matches.
Breach notificationRule 7 clocks for when a processor reports a breach.
Retention and erasureRetention rules and manual purge flags for data that must go.
Records of processingProcessing activities that show where vendors fit.
Who is a Data Processor under DPDP?
Any person who processes personal data on behalf of a Data Fiduciary. Check each vendor against that definition.
Do I need a contract with every processor?
Yes. Section 8(2) lets a Data Fiduciary engage a Data Processor only under a valid contract, and Rule 6 asks for security terms in it.
Who is responsible if my processor has a breach?
Under s.8(1) the Data Fiduciary is responsible for processing by its processors, and s.8(6) requires you to intimate the Board and each affected Data Principal.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin