Vendor Compliance Under DPDP Act: A Practical Playbook

Vendor governance is where DPDP Act programs quietly succeed or fail. Section 8(2) makes the Data Fiduciary responsible for compliance by any Data Processor it engages — meaning your vendor's mistake is your regulatory problem. This is a playbook we hand to Indian SMEs to get vendor compliance from zero to defensible in one quarter.

Step 1: Build the vendor register in one afternoon

Skip the sophisticated GRC tooling for now. Open a spreadsheet with these columns:

• Vendor name
• Category (CRM, support, marketing, analytics, HRIS, payments, infra, other)
• Business owner (single named person)
• Personal data categories processed
• Volume band (< 10k / 10k–1M / > 1M data principals)
• Sensitivity flag (financial, health, children's data, employee data)
• Contract status (signed / expiring / no DPA)
• Sub-processor list

Populate from your last 12 months of invoices. This is the fastest and most complete source. Skipping this step is why programs that look complete on paper collapse under scrutiny.

Step 2: Tier vendors by risk

Not every vendor deserves an enterprise-grade assessment. Assign three tiers:

• Tier 1 (Critical): processes sensitive data, large volumes, or is a single point of failure. Payment processors, primary CRM, HRIS, cloud infra. Full assessment, negotiated DPA, annual review.
• Tier 2 (Standard): processes personal data at moderate volumes. Marketing tools, standard SaaS. Template DPA, biennial review.
• Tier 3 (Light-touch): minimal or metadata-only processing. Monitoring tools, dev utilities. Signed DPA acceptable, no independent assessment.

The tiering decision is more important than the assessment questionnaire. A 30-question checklist run against a Tier 3 vendor is theatre; a 5-question conversation with a Tier 1 vendor is malpractice.

Step 3: Rebuild your DPA template for DPDP

The single most common failure is running a GDPR DPA and calling it done. A DPDP-native DPA covers, at minimum:

1. Scope of processing — categories of personal data, categories of data principals, purposes, duration.
2. Processor's Section 8(2) obligations — the vendor processes only on documented instructions and takes reasonable security safeguards.
3. Consent Manager cooperation (forward-looking) — vendor cooperates with any Consent Manager registered under Chapter III.
4. Sub-processor governance — no new sub-processor without written approval; sub-processors bound to equivalent terms.
5. Breach notification cascade — vendor notifies you without undue delay (target: 24 hours) of any personal data breach involving your data, with enough detail for you to meet your Section 8(6) obligations.
6. Rights request cooperation — vendor assists with access, correction, and erasure within defined SLAs.
7. Cross-border transfer clarity — countries where the vendor processes the data, plus a change-notification obligation for new countries.
8. Deletion and return — at end of engagement, all personal data returned or deleted within an agreed window (usually 30–90 days), with backups purged on cycle.
9. Audit rights — proportionate audit right, usually satisfied by SOC 2 / ISO 27001 attestations for standard vendors, with an escalation path for direct audit on cause.
10. Liability alignment — vendor's cap on liability for personal data breaches should be at least 12 months of fees or a fixed floor (₹1–5 crore) for Tier 1 relationships.

Step 4: Negotiation tactics that don't burn legal hours

• Send your paper, not theirs. Vendors will sign your DPA if you ask early and firmly. Waiting to negotiate off their template costs 3–5× the legal hours.
• Batch identical vendors. All your marketing SaaS can sign the same DPA. Draft once, send 12 times.
• Bring your MSA update at renewal. Trying to renegotiate mid-term costs commercial leverage you don't need to spend.
• Concede audit and cap; hold breach notification and sub-processor. The two things you cannot compromise on are breach notification timing and sub-processor consent. Everything else is a negotiation.
• Use SOC 2 as your assessment. For 80% of Tier 2 vendors, a current SOC 2 Type II report satisfies your diligence obligation. Read it — don't just receive it.

Step 5: Governance cadence

• Monthly: business owners flag new vendor engagements before contract signature.
• Quarterly: review Tier 1 vendors — any changes in sub-processors, breach history, or sensitivity.
• Annually: re-tier the full register, refresh assessments, and align renewals with DPA updates.

When you actually need external help

Bring in an external assessor when: (a) you have more than 40 vendors and no dedicated privacy or vendor risk analyst, (b) you're preparing for a Series B or acquisition and vendor due diligence will be an item, or (c) you've had a real vendor-side incident and need to rebuild the program with credibility.

Our vendor risk assessment service rebuilds this program in 4–6 weeks for a typical mid-size Indian SME. If you want to run it internally first, the playbook above is the exact sequence we use.