DPDP Act Compliance in Contracts: What Clauses to Add (2026)

What does the DPDP Act require in your contracts? India's Digital Personal Data Protection Act, 2023 (the DPDP Act) governs the processing of digital personal data in India. The core obligation for contracts is simple: a Data Fiduciary (the party that decides the purpose and means of processing) may only engage a Data Processor (a party that processes data on the Fiduciary's behalf) under a valid contract. Section 8(2) of the Act requires that contract before any processing is handed to a processor. The Act does not spell out exactly which clauses a data processing agreement must contain. It mandates the contract but leaves the drafting to you. The supporting Digital Personal Data Protection Rules, 2025 were notified in November 2025, with obligations rolling out in stages: the Data Protection Board from late 2025, consent-manager registration later, and the main substantive obligations (consent, breach reporting, children's data and Significant Data Fiduciary duties) phased in over 2026 and into 2027. Because the rollout is staggered, confirm which provisions are live before you rely on a deadline. <!-- [VERIFY: exact commencement dates and rule numbers against the official DPDP Rules, 2025 gazette] --> Last verified October 2026. This article is general guidance, not legal advice. Check the Act and the Rules, and take advice, before relying on specific clauses. ## Who is the fiduciary and who is the processor? - A Data Fiduciary determines the purpose and means of processing. It stays primarily accountable under the Act for the whole processing chain, including its vendors, and that accountability cannot be contracted away.

• A Data Processor processes personal data only on the Fiduciary's instructions.
• Role follows purpose, not possession. If a vendor starts using the data for its own purposes, it becomes a Fiduciary in its own right for that use, with its own obligations. A contract can give the Fiduciary a right to recover from the Processor, but it does not shift the regulatory exposure, which stays with the Fiduciary. ## The clauses to add Add these to a processing contract (often a DPDP data processing addendum) between a Fiduciary and a Processor: 1. Scope and purpose limitation. The Processor processes personal data only to perform the services and only on the Fiduciary's documented instructions, for no other purpose.

2. Security safeguards. The Processor maintains reasonable security safeguards. Under the Rules, these are expected to include measures such as encryption or tokenisation, access controls, logging and monitoring, and backups. Bind the Processor to safeguards at least equivalent to the Fiduciary's own obligations.
3. Breach notification. The Rules require the Fiduciary to report a personal data breach to the Data Protection Board, with reporting obligations tied to becoming aware of the breach. Require the Processor to notify the Fiduciary immediately, with enough detail and in time for the Fiduciary to meet its own reporting deadline to the Board. <!-- [VERIFY: the exact breach-reporting timeline and content in the DPDP Rules, 2025] -->
4. Erasure and retention. Require the Processor to erase personal data when the purpose is served or consent is withdrawn, unless law requires retention, and to support the Fiduciary's duty to notify the Data Principal before erasing their data.
5. Sub-processing. The Act is silent on sub-processing, so add what you need: require the Fiduciary's prior written authorisation before the Processor engages any sub-processor, and flow the same obligations down.
6. Assistance and data-principal rights. Require the Processor to help the Fiduciary respond to Data Principal requests (access, correction, erasure, grievance) within the Fiduciary's timelines.
7. Audit and records. Give the Fiduciary audit or inspection rights and require the Processor to keep records of its processing.
8. Return and deletion on exit. On termination, the Processor returns or deletes the data and certifies deletion.
9. Liability and indemnity. Allocate liability for the Processor's breach, remembering the Fiduciary stays accountable to the regulator regardless. ## Sample clause wording ``` DATA PROTECTION (DPDP ACT, 2023) (a) Roles. For personal data processed under this Agreement, [Client] is the Data Fiduciary and [Vendor] is the Data Processor. (b) Instructions. The Processor processes personal data only to provide the Services and only on the Fiduciary's documented instructions. (c) Security. The Processor implements and maintains reasonable security safeguards, including [encryption/tokenisation, access controls, logging, backups], at least equivalent to the Fiduciary's obligations under the Act and Rules. (d) Breach. The Processor notifies the Fiduciary without undue delay and in any event within [X] hours of becoming aware of a personal data breach, with the detail the Fiduciary needs to report to the Data Protection Board within the time the Rules require. (e) Sub-processing. The Processor will not engage any sub-processor without the Fiduciary's prior written authorisation, and will impose these same obligations on any approved sub-processor. (f) Erasure. The Processor erases personal data when the purpose ends or consent is withdrawn (unless retention is legally required) and supports the Fiduciary's notice to the Data Principal before erasure. (g) Assistance, audit and exit. The Processor assists with Data Principal requests, allows audits, and on termination returns or deletes the data and certifies deletion.

- Thinking the contract moves regulatory liability to the vendor. It does not; the Fiduciary stays accountable to the Board and can only seek recovery from the Processor.
- Leaving sub-processing silent. The Act does not cover it, so set prior-authorisation and flow-down expressly.
- Setting a breach-notice time from the Processor that is too slow for the Fiduciary to meet its own deadline to the Board.
- Treating the DPDP regime like the GDPR word for word. The concepts overlap (Fiduciary resembles controller, Processor resembles processor), but the obligations and timelines differ, so draft to the Act and Rules. ## A note on penalties and scope The Act provides for financial penalties for breaches, reported in secondary sources as running up to very large sums per instance; confirm the figures against the Schedule to the Act before citing them. <!-- [VERIFY: the penalty amounts in the Schedule to the DPDP Act, 2023] --> The DPDP Act applies to digital personal data and has its own rules on territorial scope, so check whether a given processing activity is caught. ## Where a contract workspace helps Knowing the clauses is one job; keeping them consistent is another: the same breach-notice window, sub-processing rule and erasure duty across every vendor contract, checking each incoming draft for weak or missing data-protection terms, and tracking which contracts touch personal data as the DPDP Rules phase in. Drafting DPDP clauses and flagging a missing breach-notice or sub-processing term, while tracking compliance items and key dates, can live in one AI contract workspace tuned to how your company processes data, where a change such as tightening the breach window can be applied in plain language across every contract. [Adira](https://adiralaw.com) is one workspace of that kind for data-protection terms. This guide alone is enough to brief your drafting.