Your Big Customer Sent a DPDP Questionnaire: A Supplier's Guide

Fiduciary or processor: which are you?

Under the DPDP Act the Data Fiduciary decides the purpose and means of processing. A Data Processor processes personal data on behalf of a fiduciary. The same business is usually both: a fiduciary for its own customers and employees, and a processor for the data a client gives it to deliver a service.

A payroll bureau processing a client’s employee data, a call centre handling a client’s customers, a software firm hosting a client’s users or a logistics partner holding delivery addresses are typical processors. A supplier that only receives the names and emails of a customer’s purchasing staff is a fiduciary for that limited data, not a processor.

Getting the role right matters because it decides which obligations sit with you directly and which reach you through the contract.

Why are large customers sending questionnaires now?

Section 8(1) makes the Data Fiduciary responsible for compliance in respect of processing carried out on its behalf by a processor. Section 8(2) allows a fiduciary to engage a processor only under a valid contract. A large company therefore needs written commitments from every supplier that handles personal data for it.

Rule 6 also expects fiduciaries to have appropriate contract provisions with processors for reasonable security safeguards, and Rule 7 requires breaches to be reported quickly. A customer cannot meet a 72-hour reporting window unless its suppliers tell it about incidents promptly.

Procurement teams are responding by adding DPDP sections to vendor onboarding forms, annual supplier reviews and contract renewals. For many MSMEs this is the first practical deadline, often well before 13 May 2027.

What do the questionnaires usually ask?

Expect questions on what personal data you receive, where it is stored, who can access it, whether you use sub-processors or cloud services, how you secure devices and backups, how long you keep data, how you delete it at the end of the contract and how quickly you will report a breach.

Some ask for documents: an information security policy, a breach response plan, a list of sub-processors, evidence of access reviews and staff awareness, and sometimes a certificate such as ISO 27001. A small supplier will rarely hold a certification, and an honest description of proportionate controls is better than a vague claim.

There is no official DPDP certificate. A supplier that claims to be ‘DPDP certified’ is overstating; answer with what you actually do and can show.

How should a small supplier answer?

Build a supplier pack once and reuse it: a one-page description of your data protection practices, a short security policy, your breach plan with the contact who will notify customers, a list of sub-processors, your retention and deletion approach, and a processor-side data processing agreement you are willing to sign.

Answer each question with a fact and, where possible, evidence. ‘All staff have individual logins and access is removed on exit; access is reviewed quarterly’ is stronger than ‘we take security seriously’. Where a control is not yet in place, give a date.

Read the contract terms that come with the questionnaire. Watch for unlimited indemnities, audit rights without notice, breach notification windows shorter than you can meet, and obligations to delete data that tax law requires you to keep. These can usually be negotiated.

What about your own vendors?

The same logic applies down the chain. If you pass a customer’s data to cloud storage, an email platform or a subcontractor, those are your sub-processors, and your customer will expect you to have contracts with them.

List them, accept or sign their data processing agreements and keep the list current. It is one of the first documents a customer asks for and one of the easiest to prepare.

Fiduciary or processor: common SME examples