Vendors hold your data. The duty stays with you.

Using a vendor does not move the responsibility. Sec. 8(1) of the DPDP Act keeps the Data Fiduciary responsible for any processing done by it or on its behalf by a Data Processor, "irrespective of any agreement to the contrary". Sec. 8(2) allows the engagement only under a valid contract. Everything below follows from those two lines.

Who counts as a Data Processor

Sec. 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Cloud hosts, payment gateways, SMS and email senders, analytics tools, customer-support platforms, outsourced call centres and payroll providers usually qualify. A vendor that decides its own purposes for the data is not a processor for that use; it is itself a Data Fiduciary, with its own duties. The definitions matter here, because the contract has to say which one each party is.

What the Act requires of the relationship

• A valid contract (Sec. 8(2)). The Act does not list clauses. It makes the contract a precondition.
• Security terms (Rule 6(1)(f)). The contract must contain appropriate provision for reasonable security safeguards, where applicable. Rule 6(1)(b) and (c) reach the processor's own computer resources: access control and logging.
• Security duty over processor activity (Sec. 8(5)). You protect personal data "including in respect of any processing undertaken by it or on its behalf by a Data Processor".
• Erasure through the chain (Sec. 8(7)(b)). You must cause the processor to erase data you made available to it.
• Retention that follows you (Rule 8(3)). Logs of processing carried out by a processor are retained for at least one year. The Rule's own illustration says the Fiduciary must ensure its cloud provider also retains data and logs for that period.
• Accurate data (Sec. 8(3)). Where data feeds a decision about the Data Principal or is disclosed to another Fiduciary, you ensure completeness, accuracy and consistency. A processor's stale copy can undermine that.

Contract terms that make the above workable

The Act does not prescribe these. They are the terms that turn your statutory duties into things the vendor can be held to.

1. Scope. The data, the purposes, and a statement that the processor acts only on your instructions.
2. Security. The Rule 6 list mapped to the vendor's controls, with the one-year log retention made explicit.
3. Breach notice to you. A short, fixed time from the vendor becoming aware. You need enough detail for Rule 7, including the nature, extent, timing and location of the breach, and the Board report is due within seventy-two hours of your becoming aware.
4. Withdrawal and erasure. A commitment to stop processing and erase within a defined period when you instruct, and to confirm it.
5. Sub-processors. Whether allowed, whether you approve them, and flow-down of these terms.
6. Location. Where data is stored and processed. Sec. 16 lets the government restrict transfers to notified countries; see cross-border transfer.
7. Audit and evidence. Your right to receive logs and reports you need to answer the Board.
8. Return or deletion at exit.

The breach flow from a processor

If the vendor is breached, you are the one with a duty. Sec. 8(6) and Rule 7 put intimation to the Board and to each affected Data Principal on you. The practical flow:

• the vendor tells you under the contract;
• you start the Rule 7 clock from when you become aware, and do not assume it waits for the vendor to tell you;
• you tell affected Data Principals in plain language, without delay, including what they can do to protect themselves;
• you give the Board a prompt description, then detail within seventy-two hours or a longer period the Board allows on written request.

Write this into the vendor's contract and your runbook. Breach notification covers the content of each message. Lenders and payment apps, which depend on long partner chains, should also read the fintech guide.

Deletion when a Data Principal withdraws

Withdrawal has to reach the processors. Sec. 6(6) obliges you to cease, and cause your processors to cease, processing on withdrawal, unless processing without consent is authorised by law. The Act's own illustration has a telecom provider using an emailing processor: when the customer opts for app-only bills, the provider must cause the processor to stop emailing her.

Sec. 8(7) adds erasure, unless retention is necessary for compliance with law. A processor you cannot instruct programmatically is a delay you will have to explain. The consent manager product propagates withdrawal to downstream systems; whichever tool you use, test that a withdrawal actually arrives at each vendor.

Keep a register and review it

Maintain one row per vendor: service, data categories, purposes, location, contract date, security review date, breach contact and exit plan. The records of processing can hold it. Review at onboarding, annually, and whenever a vendor changes its sub-processors or infrastructure. The substantive duties commence on 13 May 2027 under Rule 1(4), so contract renewals before then are the place to add the terms.