DPDP Third-Party Risk Assessment: A Practical Framework for Data Fiduciaries

A vendor's security failure is your regulatory exposure. The DPDP Act says so explicitly. This framework covers seven steps — from classifying every vendor as a Processor or independent Fiduciary, through DPA adequacy and Rule 6 evidence, to sector-specific BFSI overlays and ongoing monitoring — that organisations must execute before May 2027.