12 Mandatory DPA Clauses

Under DPDP Act Sections 8 and 9, a Data Processing Agreement with every vendor (Data Processor) must contain the following clauses. Missing any single clause creates a compliance gap.

Clause 1: Purpose Limitation — Data Processor shall process personal data only for the specific purposes defined by the Data Fiduciary and documented in the agreement.
Clause 2: Processing Instructions — Data Processor shall act only on documented instructions from the Data Fiduciary, including for cross-border transfers.
Clause 3: Confidentiality Obligation — All personnel with access to personal data must be bound by confidentiality agreements or statutory obligations.
Clause 4: Security Measures — Data Processor must implement reasonable security safeguards (technical and organisational) as prescribed under §8(4) of the DPDP Act.
Clause 5: Sub-Processor Restrictions — No sub-processing without prior written authorisation from the Data Fiduciary. Sub-processor must be bound by equivalent obligations.
Clause 6: Data Principal Rights Assistance — Data Processor must assist the Data Fiduciary in responding to Data Principal rights requests (access, correction, erasure) within prescribed timelines.
Clause 7: Breach Notification — Data Processor must notify the Data Fiduciary of any personal data breach without unreasonable delay, enabling the Fiduciary to meet DPBI 72-hour reporting obligation.
Clause 8: Data Deletion on Termination — Upon contract termination or expiry, Data Processor must delete or return all personal data and provide a formal deletion certificate.
Clause 9: Audit & Inspection Rights — Data Fiduciary retains the right to audit the Data Processor's compliance with DPA obligations, including on-site inspection.
Clause 10: Data Localisation Declaration — Where applicable (BFSI, government), Data Processor must declare and maintain personal data within India unless exempted.
Clause 11: Indemnification — Data Processor indemnifies the Data Fiduciary for losses arising from the Processor's non-compliance with DPA obligations or data breaches caused by the Processor.
Clause 12: Compliance Evidence — Data Processor must provide evidence of compliance (certifications, audit reports, security assessments) upon request by the Data Fiduciary or regulatory authority.