Vendor Contracts Under the DPDP Act: A DPA Checklist for Tally, Zoho, Payroll and CRM Users
A typical small business shares personal data with ten or more outside providers: accounting software, payroll, a CRM, email marketing, cloud storage, a WhatsApp API provider, the website developer and IT support. Under the DPDP Act each of them that processes data on your behalf is a Data Processor, and you may engage one only under a valid contract. You also stay responsible for what they do with the data.
Which of your vendors are data processors?
A vendor is your Data Processor when it stores or handles personal data for your purposes and on your instructions. Cloud accounting and ERP, payroll and HRMS platforms, CRMs, email and SMS platforms, WhatsApp Business API providers, cloud storage, website hosting, IT support with access to your systems and call-centre or collection agencies all usually qualify.
A vendor that decides for itself why it uses the data, such as a bank or a statutory authority, is not your processor. A courier that receives a delivery address to deliver your parcel is closer to a processor for that limited data.
Start with a vendor list: the vendor, what personal data it holds, where it stores it, who in your business owns the relationship and whether a data processing agreement is in place.
What does the DPDP Act require of the contract?
The Act requires a valid contract but does not prescribe its clauses. Its other duties tell you what the contract must make possible: reasonable security safeguards under section 8(5) and Rule 6, breach intimation under section 8(6) and Rule 7, and erasure under section 8(7), which includes causing your processor to erase data it holds for you.
Because you remain responsible under section 8(1), the contract is how you pass those duties down the chain and how you show the Board that you took reasonable steps. Without it, a vendor’s breach is simply your breach with no recourse.
Cross-border hosting is permitted under section 16 unless the Government restricts transfers to a notified country, so a provider’s overseas servers are not a problem in themselves. Record where data is hosted so you can respond if a restriction is notified.
Large providers vs small vendors
Most large software providers publish a data processing agreement or addendum, often accepted through the admin console or incorporated into the online terms. Download a copy, record the date of acceptance and keep it in the compliance file.
Small vendors such as a local web developer, an IT support firm or a freelancer rarely have one. A two-page addendum to the existing engagement, covering the checklist below, is usually enough and is easy for them to sign.
Where a vendor will not agree to reasonable terms, weigh the risk: reduce the data it receives, mask identifiers, or move to a provider that will.
Data processing agreement checklist
| Clause | What it should say |
|---|---|
| Purpose and instructions | Process personal data only for the agreed service and on your documented instructions |
| Security | Maintain reasonable safeguards, such as access control, encryption, logging and backups |
| Confidentiality | Staff with access are bound by confidentiality |
| Breach notice | Tell you promptly, within a set number of hours, with the facts you need for Rule 7 |
| Sub-processors | Disclose sub-processors and flow down equivalent terms |
| Location | State where data is stored and processed |
| Rights requests | Help you respond to access, correction and erasure requests |
| Deletion or return | Delete or return data at the end of the service, subject to legal retention |
| Audit and evidence | Provide reasonable evidence of compliance on request |
How to put vendor contracts in place
Build the vendor list
Every app and service provider that stores or handles personal data for you, with the data involved and its location.
Rank by risk
Start with vendors holding customer databases, employee KYC and payroll, or children’s or health data.
Accept published DPAs
For large providers, accept the published data processing agreement and save a dated copy.
Send an addendum to small vendors
Use a short addendum covering the checklist clauses and ask for signature with the next invoice or renewal.
Minimise what you share
Send vendors only the fields they need; mask identifiers where possible.
Review on change
Add the check to vendor onboarding and to your quarterly compliance review.
Frequently Asked Questions
- Is Tally, Zoho or Google Workspace my data processor?
- When it stores or processes your customers’ or employees’ personal data for your purposes, yes. You need contract terms with it; most such providers publish a data processing agreement you can accept.
- Does the DPDP Act prescribe the clauses of a data processing agreement?
- No. Section 8(2) requires a valid contract, and the Act’s duties on security, breach intimation and erasure indicate what the contract must cover.
- Am I liable if my vendor has a data breach?
- Section 8(1) keeps the Data Fiduciary responsible for processing done on its behalf, so you must intimate the breach and show reasonable steps. Contract terms let you recover and get the facts quickly.
- Can my data be stored on servers outside India?
- Yes, unless the Government notifies a restriction on transfers to a particular country under section 16. Record where each vendor stores your data.
- What if a small vendor will not sign an addendum?
- Reduce the personal data it receives, mask identifiers, or consider a provider that will agree to reasonable terms. Record the decision in your compliance file.
Related reading: When your customer sends a DPDP questionnaire · ERP and process automation · DPDP compliance for small businesses
Sources: India Code: Digital Personal Data Protection Act, 2023 · PIB: DPDP Rules, 2025 notified (17 November 2025)
Updated November 2026 · Regi Tom Antony, FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA)
Regi Tom Antony & Associates, Chartered Accountants, ICAI FRN 007670S
DPDP Essentials and Complete engagements include a vendor list and processor terms for your key apps, aligned with the rest of your compliance file.
DPDP compliance for small businessesGet the DPDP readiness checklist
We email the checklist (PDF) and reply within one business day to discuss your business.