Section 8(2) of the DPDPA creates an effectively non-delegable responsibility for Data Fiduciaries over their Data Processors. Unlike GDPR Article 28, which provides detailed processor contract requirements, the DPDPA delegates the specifics to the Rules. Rule 6 of the DPDP Rules, 2025 now operationalises this obligation with concrete contractual requirements. For foreign entities operating in India through outsourced IT services, cloud providers, payroll processors, or managed service providers, the gap between their existing global DPA and DPDPA's requirements represents an immediate compliance risk. This article maps the 11 essential clauses that must appear in every DPDPA-compliant processor agreement.
The Non-Delegable Responsibility Framework
DPDPA Section 8(2) establishes that the Data Fiduciary retains responsibility for the actions of its Data Processor. This is not a contractual liability pass-through — it is a statutory responsibility that cannot be transferred through indemnity clauses, liability caps, or limitation-of-liability provisions. When a processor breaches personal data, the Fiduciary faces Board proceedings regardless of contractual allocation. This framework means that a foreign entity's India subsidiary cannot contractually insulate itself from processor failures. The subsidiary must demonstrate active governance: due diligence before engagement, ongoing monitoring during the contract, and documented oversight of processing activities.
Key Points
- Statutory responsibility — cannot be transferred contractually
- Indemnity clauses do not reduce Board exposure
- Active governance required: due diligence + ongoing monitoring
- Fiduciary faces proceedings for processor breaches
The 11 Essential Clauses Under Rule 6
A DPDPA-compliant processor contract must address: (1) Specific processing scope — what data, for what purpose, under what conditions. (2) Security safeguards — technical and organisational measures commensurate with the data sensitivity. (3) Sub-processor controls — prior written approval, flow-down obligations, sub-processor register. (4) Data Principal rights facilitation — processor's obligation to assist with access, correction, and erasure requests within SLAs. (5) Breach notification — processor must notify Fiduciary without delay, enabling compliance with Rule 7 timelines. (6) Deletion on termination — complete erasure or return of personal data upon contract conclusion. (7) Audit rights — Fiduciary's right to audit or appoint an independent auditor. (8) Processing records — maintenance of processing activity logs. (9) Confidentiality — binding on processor personnel. (10) Cross-border restrictions — processor cannot transfer data outside India without Fiduciary's instruction, subject to Section 16. (11) Cooperation with Board — processor must assist in Board proceedings and information requests.
Key Points
- Specific scope — not open-ended processing authority
- Sub-processor requires prior written approval
- Breach notification to Fiduciary without delay
- Complete data deletion on contract termination
Where Global DPAs Fall Short
Most multinational enterprises rely on standardised Data Processing Agreements drafted for GDPR compliance. These agreements fail DPDPA requirements in several critical areas. First, GDPR DPAs reference Standard Contractual Clauses (SCCs) for cross-border transfers — DPDPA has no SCC equivalent; it uses the negative list approach under Section 16. Second, GDPR DPAs specify a 72-hour breach notification period — DPDPA Rule 7 requires notification "without unreasonable delay" and mandates parallel CERT-In reporting. Third, GDPR DPAs may permit sub-processing with notification-only — DPDPA requires prior written approval. Fourth, GDPR DPAs often include mutual limitation-of-liability clauses — these have no effect on statutory Board proceedings under DPDPA. A foreign entity that relies solely on its global DPA for India operations has a documentation gap that becomes evident only during a Board inquiry.
Key Points
- No SCC equivalent — negative list model instead
- CERT-In parallel reporting not covered in GDPR DPAs
- Sub-processor: approval required, not just notification
- Limitation-of-liability clauses irrelevant to Board
Practical Implementation for Foreign Entities
The implementation path for foreign entities involves three workstreams. First, audit all existing India processor relationships — IT outsourcing (TCS, Infosys, Wipro, HCL), cloud providers (AWS India, Azure India), HR platforms (Workday, SAP SuccessFactors), CRM systems (Salesforce), and managed security providers. Second, develop a DPDPA-specific addendum template that supplements (not replaces) the global DPA. This addendum addresses the gaps identified above — DPDPA-specific scope, Indian breach notification chain, sub-processor approval mechanism, Board cooperation obligations, and Section 16 transfer conditions. Third, establish a processor governance calendar: annual audit rights exercise, quarterly sub-processor register review, breach simulation drills, and contract renewal checkpoints. Documentation of these governance activities becomes the primary evidence in Board proceedings.
Key Takeaways
Section 8(2) creates non-delegable responsibility — contractual indemnities do not reduce Board exposure
Every India processor contract needs 11 essential DPDPA clauses beyond standard GDPR DPA terms
Global DPAs fail on four DPDPA-specific requirements: SCCs, breach timelines, sub-processor approval, Board proceedings
Develop a DPDPA addendum template that supplements your global DPA for all India processor relationships
Establish a processor governance calendar with audit exercises, sub-processor reviews, and breach simulations
Documentation of governance activities is the primary defence in Board proceedings