What is a data processor under the DPDP Act?

A data processor is any entity that processes personal data on behalf of a Data Fiduciary. This includes cloud hosting providers, CRM vendors, analytics platforms, payment gateways, marketing tools, and any other third-party service that receives, stores, or processes personal data of your users. Under the DPDP Act, Data Fiduciaries are responsible for ensuring their processors handle data in a compliant manner.

What should a DPDP vendor register include?

A DPDP vendor register should capture: the vendor name and contact details, the categories of personal data shared with the vendor, the purpose of processing, the legal basis for sharing, the data retention period at the vendor, whether data is transferred outside India, the contractual safeguards in place (Data Processing Agreement), the vendor's security certifications, and the date of last review. It should be reviewed at least annually.

Do I need a Data Processing Agreement with every vendor?

Yes. Under the DPDP Act, Data Fiduciaries must ensure that data processors process personal data only in accordance with their instructions and implement appropriate security safeguards. A Data Processing Agreement (DPA) is the standard legal mechanism to achieve this. The DPA should specify the nature of processing, the categories of data, the duration, the processor's obligations, and the procedure for handling Data Principal rights requests and breach notifications.

How do I handle sub-processors under the DPDP Act?

Your Data Processing Agreements should require processors to seek your prior written approval before engaging sub-processors. When a sub-processor is approved, the same data protection obligations must flow down through the contract. Sub-processors should be listed in your vendor register, either as separate entries or as appendices to the primary vendor's record.

Can I transfer personal data outside India under the DPDP Act?

The DPDP Act permits cross-border data transfers, but the Central Government may restrict transfers to specific countries or categories of entities by notification. Before transferring personal data to a vendor or sub-processor located outside India, verify that the destination country is not on any restricted list notified by the Central Government. Document the transfer basis in your vendor register.

How often should I review my vendor register?

At minimum, review your vendor register annually or whenever you onboard a new vendor, change the scope of processing with an existing vendor, or become aware of a vendor security incident. Significant Data Fiduciaries under the DPDP Act are expected to conduct periodic data audits, which should include vendor register reviews.

Template

DPDP vendor register template.

Use this structure to list the tools and partners that process personal data for your business.

Vendor register fields

Capture these fields for every tool, partner, agency, platform, or processor:

Vendor name and website.
Business owner inside your company.
Purpose of processing.
Personal data categories handled.
User group affected: customers, employees, learners, patients, leads, vendors, or partners.
Data location or hosting region, where known.
Contract, DPA, or terms link.
Retention or deletion expectation.
Security evidence available.
Risk rating and next review date.

Common vendors to include

Do not limit the register to obvious IT systems. Include CRM, analytics, payment gateways, email marketing, WhatsApp tools, ad platforms, support desks, hosting providers, product analytics, logistics partners, agencies, and spreadsheet-based processes.

Ask for a vendor-register review