Data processing addendum (DPDP): clause outline
1. Parties and scope
Data Fiduciary (legal name):
Data Processor (legal name):
Main agreement this addendum supplements (name and date):
Services the Processor provides:
Personal data covered (itemise):
Data Principals covered (for example customers or employees):
Purpose of processing:
Duration of processing:
2. Instructions (s.8(2))
This addendum is the contract under which the Fiduciary engages the Processor to process personal data on its behalf.
The Processor processes personal data only on the Fiduciary's documented instructions and only for the purpose stated above.
The Processor does not use the personal data for its own purposes.
3. Security safeguards (s.8(5), Rule 6)
The Processor maintains reasonable security safeguards, including at least the measures in Rule 6.
Encryption, obfuscation, masking or virtual tokens for personal data.
Access control, with access logs that are monitored and reviewed.
Backups and measures for continuity.
Retention of logs and personal data for one year to detect and investigate unauthorised access, unless another law requires otherwise.
Description of the Processor's measures (attach as an annex):
4. Personal data breach
The Processor notifies the Fiduciary without delay on becoming aware of a personal data breach affecting the Fiduciary's personal data.
The notice includes what the Processor knows of the nature, extent and timing of the breach, its likely consequences and the steps taken.
The Processor helps the Fiduciary prepare its intimations and the detailed report Rule 7 requires.
Processor's breach contact (name, email, phone):
Fiduciary's breach contact (name, email, phone):
5. Withdrawal of consent and erasure (s.6(6), s.8(7))
When the Fiduciary tells the Processor that consent has been withdrawn, the Processor stops processing within a reasonable time.
On the Fiduciary's instruction, the Processor erases the personal data, including when consent is withdrawn or the purpose is no longer served, unless a law requires it to be retained.
Time to complete erasure after an instruction:
6. Sub-processors
The Processor engages a sub-processor only with the Fiduciary's prior written approval.
The Processor places the same obligations on each sub-processor and remains responsible to the Fiduciary for its work.
Approved sub-processors (name, service, location):
Notice period before adding or changing a sub-processor:
7. Transfers outside India (s.16)
The Processor tells the Fiduciary before processing or storing the personal data in a new country, so the Fiduciary can check any restriction notified under s.16.
Countries where the personal data is processed or stored:
8. Audit and information
The Processor gives the Fiduciary the information it needs to show compliance with the Act and the Rules.
The Processor allows audits by the Fiduciary or an auditor it appoints, on reasonable notice.
Audit notice period:
9. End of services
At the end of the services, the Processor returns or deletes the personal data, as the Fiduciary chooses, unless a law requires it to be retained, and confirms this in writing.
Deadline for return or deletion:
Confirmation of deletion signed by (name and designation):
10. Signatures
For the Data Fiduciary (name, designation, date):
For the Data Processor (name, designation, date):