Model data-processing addendum

A model for small businesses to adapt when a vendor handles personal data on their behalf: a payroll agency, IT support person, courier, software developer, call centre or similar. It is drafted against the Digital Personal Data Protection Act, 2023 (the Act) and the Digital Personal Data Protection Rules, 2025 (the Rules), with the law stated as at 28 October 2026. Words in [square brackets] are to be completed or chosen.

Please read before use. This model form is general material, offered free for information only. It is not legal advice on any particular arrangement and does not create an advocate–client relationship with anyone who reads or uses it. It may not suit every business, vendor or transaction, and the law may change after the date above. Anyone using it is responsible for adapting it to their own facts and for checking the law in force at the time of use. To the extent permitted by law, the author accepts no liability for any loss or claim arising from its use.

Data-Processing Addendum

This Addendum is made on [date] between [name of business], [address] (the Business), and [name of vendor], [address] (the Vendor). It supplements the [agreement / purchase order / engagement] dated [date] between them (the Main Agreement). If the two conflict on the handling of personal data, this Addendum prevails.

1. Parties' roles and the data

1.1 The Business decides the purpose and means of processing and is the Data Fiduciary. The Vendor processes personal data only on the Business's behalf and is a Data Processor.

1.2 The Vendor will handle the following personal data: [for example, names, phone numbers and addresses of customers; salary and bank details of employees], of the following persons: [customers / employees / others], for the following purpose only: [describe the service].

Note: The Act defines these roles in s. 2(i) and s. 2(k). A Data Processor may process personal data for a Data Fiduciary only under a valid contract (s. 8(2)).

2. Instructions

2.1 The Vendor will process the personal data only on the Business's written instructions (email is enough) and only for the purpose in clause 1.2.

2.2 If the Vendor believes an instruction is unlawful, it will tell the Business promptly before acting on it.

Note: The Business remains responsible for compliance, including for processing by its Data Processor, "irrespective of any agreement to the contrary" (s. 8(1)). Clear instructions are how the Business keeps control.

3. No use for the Vendor's own purposes

3.1 The Vendor will not use the personal data, or anything derived from it, for its own purposes. This includes marketing, resale, profiling, and training or improving any software or artificial-intelligence model, unless the Business agrees in writing in advance.

Note: A vendor that decides its own purposes for the data may itself be treated as deciding "the purpose and means of processing" (s. 2(i)).

4. Security

4.1 The Vendor will take reasonable security safeguards to protect the personal data, including at least:

1. securing the data through encryption, obfuscation, masking or virtual tokens, as appropriate;
2. controlling who can access the systems and data, and limiting access to staff who need it;
3. keeping logs of access and monitoring them, so that unauthorised access can be detected and investigated;
4. keeping backups, so that the service can continue if data is lost or compromised;
5. keeping the logs and data needed to investigate an incident for one year, unless a law requires otherwise;
6. technical and organisational measures, including staff confidentiality undertakings, to make these safeguards work in practice.

Note: These track the minimum measures in Rule 6(1)(a)–(g). Rule 6(1)(f) expressly requires the contract between a Data Fiduciary and a Data Processor to provide for reasonable security safeguards.

5. Breach notice

5.1 If the Vendor becomes aware of any breach affecting the personal data, it will inform the Business at [email / phone of named person] within [4] hours of becoming aware.

5.2 The notice will describe, as far as then known: what happened, when and where; the data and persons affected; the likely impact; what the Vendor has done to contain it; and, when known, who caused it. The Vendor will update the Business as more becomes known and will cooperate in any notice the Business must give.

Note: The Business must inform the Data Protection Board and each affected person, and send the Board a detailed report within seventy-two hours of becoming aware of the breach (s. 8(6); Rule 7(1) and 7(2)(b)). The CERT-In Directions of 28 April 2022 require listed incidents, including data breaches, to be reported to CERT-In within six hours of noticing them. The window in clause 5.1 should leave the Business time to meet both; four hours is suggested, and a shorter period may be agreed.

6. Logs and records

6.1 The Vendor will keep logs of its processing of the personal data for [one year / such longer period as law requires], and will give the Business access to them on reasonable request.

Note: Rule 8(3) requires personal data, traffic data and processing logs, including processing by a Data Processor, to be retained for at least one year from processing. CERT-In Direction (iv) requires ICT system logs to be kept for a rolling 180 days within India.

7. Sub-vendors

7.1 The Vendor will not engage any other person to process the personal data without telling the Business in advance. The current list is: [names, or "none"].

7.2 The Vendor will bind any such person to obligations no less protective than this Addendum and remains responsible to the Business for them.

8. Location of data

8.1 The personal data and its backups are stored in: [India / name the countries]. The Vendor will tell the Business in advance before moving them to another country, and will comply with any restriction notified by the Central Government.

Note: The Central Government may restrict transfers to particular countries by notification (s. 16(1)) and Rule 15 allows the Central Government, by general or special order, to set requirements on making personal data available to a foreign State or to entities under its control.

9. End of the service

9.1 When the Main Agreement ends, or earlier if the Business asks, the Vendor will return the personal data to the Business in a usable format and then erase it from its systems, including backups, within [__] days.

9.2 The Vendor will confirm the erasure in writing. It may keep only what a law requires it to keep, for the period that law requires, and will tell the Business what it keeps and why.

Note: The Business must cause its Data Processor to erase personal data made available to it once the purpose is served or consent is withdrawn, unless retention is required by law (s. 8(7)).

10. Cooperation and costs

10.1 The Vendor will cooperate with the Business in responding to requests from individuals, the Data Protection Board or any other authority concerning the personal data.

10.2 Where a breach results from the Vendor's failure to comply with this Addendum, the Vendor will bear the reasonable costs of investigating it, notifying affected persons and restoring the data, in addition to, and not limited by, any limit of liability in the Main Agreement.

Note: Whether a monetary penalty imposed by the Board can be passed on to a vendor under a contract is not settled by the Act. This clause addresses response costs only.

11. Signatures

For the Business: ______________________ Name: [ ] Designation: [ ] Date: [ ]

For the Vendor: ______________________ Name: [ ] Designation: [ ] Date: [ ]

Vendor check sheet

For large software providers whose standard terms cannot be negotiated, record these points at sign-up and keep a copy of the terms accepted on that date.

Question	Where to look	Answer
What personal data will this tool hold?	Your own use of the tool
Do the terms say the vendor acts on your instructions and does not use the data for its own purposes (including AI training)?	Terms of service, data-processing addendum, privacy policy
Do the terms describe security measures?	Security page, trust centre
Will the vendor tell you about a breach, and how fast?	Data-processing addendum, security page
Where is the data stored? Can you choose India?	Account settings, data-residency page
Can you export and delete your data when you leave?	Help pages, account settings
Are two-factor login and user roles switched on?	Account settings
Date terms were saved, and where