You can outsource the processing.You cannot outsource the liability.

Section 8(1) keeps the Data Fiduciary responsible, whoever does the work.

In one line: Yes. Section 8(1) makes the Data Fiduciary responsible for complying with the Act in respect of processing undertaken by it or on its behalf by a Data Processor.

The estate · Your vendor is your liabilityHover to inspect

Their breach. Your penalty.

The scene

The analytics SDK was added in an afternoon by a growth engineer. It collected device identifiers, location and in-app events, and sent them to a server abroad. There was no contract, only terms of service accepted with a click. Three years later it was still there, and still sending.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
The vendor's terms cover us. Their terms protect them. Section 8(2) requires a valid contract for engaging a processor. Your paper, your terms, your audit right.
SDKs aren't vendors. Anything that receives personal data on your behalf is processing it. Inventory every SDK and pixel as a processor.
Cloud is the provider's problem. Shared responsibility still leaves configuration, access and keys with you. Know which half of the model is yours.

Cross-border transfers

Section 16 permits transfers outside India except to countries the Government restricts by notification. Sectoral rules, such as those on payment data, can be stricter and continue to apply.

Monday morning

  1. 01Pull the list of every vendor that touches personal data.
  2. 02Mark which have a DPDPA-grade processing contract. Most will not.
  3. 03Start with the ones that hold the most people, not the biggest invoice.

Questions, answered plainly

Is a Data Fiduciary liable for its Data Processor under DPDPA?

Yes. Section 8(1) makes the Data Fiduciary responsible for complying with the Act in respect of processing undertaken by it or on its behalf by a Data Processor.

Does DPDPA require a contract with Data Processors?

Yes. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract.

Argument 07Privacy is not a department. It is a board decision.Read → Argument 08₹250 crore is not a line item. It is a balance-sheet event.Read → Argument 01Implementation ends on a date. Resilience begins on it.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner