The Hidden Risk in Your Data Processing Agreements

One of the biggest challenges in DPDP implementation isn't technology alone. It's poorly drafted Data Processing Agreements.

Yesterday, I was reviewing a Data Processing Agreement on behalf of one of our clients.

This time, we were advising the Data Processor, not the Data Fiduciary.

As I read through the agreement, I experienced a sense of déjà vu.

The very same gaps that I had noticed while reviewing agreements for other clients over the past year were present here as well.

That's when I realised that one of the biggest challenges in DPDP implementation isn't technology alone. It's poorly drafted Data Processing Agreements.

Most agreements do a good job of covering commercial terms, confidentiality, and information security.

However, in our experience, many agreements do not clearly allocate responsibilities under the Digital Personal Data Protection Act, 2023 (DPDP Act) between the Data Fiduciary and the Data Processor.

Some of the recurring gaps we continue to see are:

• Responsibilities relating to lawful processing and onward sharing of personal data are often not clearly allocated, particularly where the Data Processor is expected to transfer or disclose personal data to other entities as part of the agreed business process.
• There is little clarity on how personal data will be transferred to, received by, processed within, shared by, or returned from the Data Processor's ecosystem, including the respective responsibilities of each party throughout the data lifecycle.
• The agreement often fails to clearly define the reasonable security safeguards expected from the Data Processor, leaving requirements such as encryption, masking or pseudonymisation, tokenisation, access controls, logging, and other appropriate safeguards open to interpretation.
• Data retention, return, and secure deletion obligations are frequently incomplete or not aligned with contractual, business, or legal requirements.
• Responsibilities relating to personal data breaches, grievance handling, audit support, regulatory cooperation, and compliance reporting are often ambiguous or operationally impractical.

These may appear to be minor drafting gaps today.

Tomorrow, they could determine contractual liability, regulatory exposure, and financial loss.

A Data Processing Agreement is not just another vendor agreement.

It is the legal document that allocates responsibility, accountability, and risk between the Data Fiduciary and the Data Processor. While the DPDP Act establishes the legal obligations, the agreement should clearly define how those obligations will be operationalised between the parties.

My advice is simple.

If you are a Data Fiduciary, clearly define your legal expectations and statutory responsibilities.

If you are a Data Processor, don't negotiate only the commercials. Understand every privacy and compliance obligation before signing the agreement.

A well-drafted Data Processing Agreement doesn't just protect personal data. It protects the relationship between the Data Fiduciary and the Data Processor — and, ultimately, the interests of the Data Principal.