Vendor Data Processing Agreement: What to Ask SaaS Providers
A data-processing agreement checklist covering instructions, confidentiality, security, sub-processors, incidents, rights support, deletion and audits.
A vendor security page does not replace a contract that says what happens to customer data when service changes, breaches or ends.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Rule 6’s future safeguards include appropriate Data Fiduciary–Data Processor contract provisions.
The buyer should determine whether the vendor acts only on instructions or has independent purposes.
A DPA should match actual architecture, data types, locations, sub-processors and support.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Rule 6’s future safeguards include appropriate Data Fiduciary–Data Processor contract provisions.
- The buyer should determine whether the vendor acts only on instructions or has independent purposes.
- A DPA should match actual architecture, data types, locations, sub-processors and support.
- Deletion and return should address backups, derived data, logs and legal retention.
The five-point review
| Check | What to examine |
|---|---|
| Scope | Services, data, people and purpose. |
| Instruction | Permitted and prohibited use. |
| Security | Access, encryption, logs and backups. |
| Incident | Notice timing and cooperation. |
| Exit | Return, deletion and transition. |
Practical example
A CRM vendor may use customer data to improve all products and share it with unnamed partners. The buyer must classify that role and decide whether the expansion is acceptable before signing.
How to apply the framework
Attach a processing schedule listing fields, systems, countries and sub-processors.
Set vendor incident notice shorter than the buyer’s external reporting clock.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review scope, instruction and security together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Implementation checkpoint
Before closing the review, assign a named owner, a completion date and a live-system test that proves the control works. A policy statement is not enough when the product, vendor, support team, payment process or access configuration behaves differently. Preserve the test result, exception approval and remediation ticket so management can distinguish an operating control from an intention that has not yet been implemented.
Action checklist
- Classify vendor role.
- List data and purposes.
- Set security requirements.
- Control sub-processors.
- Define incident support.
- Require verifiable deletion.
Evidence to keep
- Agreement and DPA
- Processing schedule
- Security evidence
- Incident workflow
- Deletion certificate
Warning signs
- Unlimited product-improvement rights
- Sub-processor changes without notice
- No evidence preservation
- Deletion excludes all backups
- Liability cap unrelated to risk
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.