Back
's 2025 Impose Strict for Data Fiduciaries
The (), along with the recently notified , has fundamentally recalibrated the compliance landscape for Indian businesses. While many organisations have focused on internal privacy policies and cybersecurity measures, the new regime makes clear that regulatory accountability cannot be outsourced. In an era where personal data routinely flows through cloud platforms, SaaS tools, payroll administrators, and marketing analytics providers, the —the entity that determines the purpose and means of processing—remains squarely on the hook for every breach, every failure to notify, and every lapse in security, regardless of whether the actual processing was performed by a third-party processor.
“A vendor may take on operational responsibility, but regulatory accountability cannot be delegated away,” the analysis of the DPDP framework underscores. This principle has profound implications for general counsel, compliance officers, and board members who must now treat vendor relationships not as peripheral procurement matters, but as core privacy governance challenges.
The Unshifting Burden of Accountability
The threshold question in any vendor engagement is classification—not contractual labeling. Under the Act, a decides the “why” and “how” of processing, while a merely acts on its behalf. Cloud-hosting providers, CRM platforms, payroll administrators, and background-verification agencies are typical processors. However, a contract that labels a vendor as a “” is not determinative if, in substance, the vendor retains independent discretion over data use—for instance, by using client data for its own analytics or product development. Such a vendor may become a , bearing direct duties under the Act.
This classification determines everything: the substance of the contract, the depth of , the allocation of liability, and the extent of ongoing monitoring. Misclassification can expose a to regulatory action even when the vendor is the party that actually mishandled the data.
The Criticality of Vendor Contracts
Once a vendor is correctly identified as a processor, the risks become practical rather than theoretical. The , particularly , require the to protect personal data in its possession or control, including processing undertaken on its behalf. This obligation must be mirrored in the contract with the processor. The Rules mandate that processor contracts include provisions requiring the same security safeguards—encryption, access control, monitoring, and backup arrangements—that the fiduciary itself must maintain.
A well-negotiated is no longer a boilerplate appendix. It must set out precisely the scope and purpose of processing; confirm that the vendor acts only on documented instructions; require before engaging ; grant meaningful ; and mandate periodic . Crucially, the contract must also address . of the requires return or destruction of data upon termination, including from backups, and a of the same. Without such terms, a may find itself unable to comply with its own statutory .
The : A Structural Trap
Perhaps the most acute risk arises in the event of a . The impose a on the : first, to inform each affected without delay; second, to report to the within 72 hours, with a full report of the assessed impact and remedial measures. This obligation lies squarely on the , not the vendor.
If the vendor contract does not require the processor to promptly notify the fiduciary—well within that 72-hour window—the fiduciary is structurally incapable of meeting its statutory deadline. The penalties are severe: up to Rs. 250 crore for failure to implement and Rs. 200 crore for failure to notify a breach. A company may have robust internal cybersecurity, but if its payroll vendor or CRM vendor is breached and fails to provide timely notice, the fiduciary bears the regulatory consequence.
Cloud, SaaS, and AI: A New Frontier of Risk
The difficulty is most acute with cloud, SaaS, and generative AI vendors, where reliance is now embedded in almost every business function. Employees routinely enter personal data into AI platforms in the ordinary course of work. Vendors’ own AI features may process customer data and, without explicit contractual restrictions, use prompts or inputs to train or improve models. Contracts with such vendors must explicitly address confidentiality of inputs, prohibition on secondary use (including model training), data retention within the platform, and onward sub-processing to underlying foundation-model providers.
also come into play. The allows transfer outside India except to jurisdictions restricted by government notification, and retains the government’s power to impose additional conditions. Global SaaS arrangements and intra-group data sharing with an overseas parent cannot be assumed to fall outside the fiduciary-processor framework simply because they are within a single corporate group. The same questions of location, access, and contractual protection apply with equal force.
Sub-Processing and the Extended Chain
Data rarely stops at a single vendor. A realistic chain runs from the fiduciary to a primary vendor, to that vendor’s , to underlying cloud infrastructure, and often to further downstream providers. The longer this chain, the harder it becomes for the fiduciary to know with confidence where its data resides, who can access it, and whether it is genuinely and verifiably deleted. Sub-processing issues raise recurring questions of , flow-down of obligations, and accountability if the sub-processor is the source of a failure.
The require the fiduciary to ensure that equivalent obligations flow down the chain. Contracts must therefore include provisions for prior notification or approval before are engaged, and must bind those to the same security and deletion standards.
Building a Framework
should be managed as an , not a compliance checkbox. The analysis recommends segmenting vendors based on the volume and sensitivity of data involved and the importance of the relationship. Full and tailored terms should apply to high-risk vendors dealing with sensitive or large volumes of data; proportionate terms for medium-risk relationships; and a lighter, mostly self-certified process for the rest.
Crucially, the relationship does not end with contract termination. Residual information may linger in vendor databases. Backups may exist on independent cycles. may have copies that were never returned. Logs may retain personal data long after termination. The must ensure that its vendor contracts independently require deletion, destruction of backups, and on exit—including during migration to a replacement vendor.
“The statute creates the legal obligation; commercial contracts and determine whether a business can actually manage the risk that results,” the analysis concludes. For general counsel and boards, the practical starting point remains simple: know every vendor that touches personal data, know precisely what each one does with it, and ensure the contract governing that relationship—not merely the organisation’s internal policy—is capable of standing up to regulatory scrutiny.
Conclusion: From Policy to
The modern privacy perimeter does not end at the company’s firewall. A company may have a comprehensive privacy policy, strong internal compliance procedures, and robust cybersecurity—and still face substantial regulatory and commercial exposure due to a third-party processor over which it had insufficient contractual and operational control. The compliance must evolve from a policy-centric exercise into an ecosystem-based governance model, in which vendor selection, contracting, cybersecurity, ongoing monitoring, and exit management are treated as integral to privacy compliance rather than peripheral to it.
The new Rules have raised the stakes significantly. For data fiduciaries, the message is unmistakable: you can outsource processing, but you cannot outsource accountability. The contracts you sign today will determine whether you can weather a breach tomorrow.
