Data Processors Under the DPDP Act: Key Compliance Insights

Most businesses do not handle personal data alone. They engage other vendors and companies i.e. Data Processors to store data, send messages with it, run payroll on it or to take payments.

This blog explains:

• who a Data Processor is,
• what their obligations are,
• when a Data Processor turns into a Data Fiduciary, and
• what a business must do before it shares data with a Data Processor.

Who is a Data Processor under the DPDP Act?

As per Section 2(k) of the DPDP Act, a Data Processor is a company, a firm or an individual who processes personal data on behalf of another company (the Data Fiduciary), under its instructions.

A Data Processor does not decide why the data is needed or how it is used. The Data Fiduciary makes these decisions, and the Data Processor only follows its instructions.

Common examples of Data Processors are cloud storage providers, payment gateways, payroll vendors, call centres and email or SMS tools.

Can a Data Processor collect data?

Yes. A Data Processor can collect data on behalf of a business, or it can process the data after the business has already collected it. This is because processing covers nearly everything done with data: collecting it, storing it, using it, sharing it or deleting it (Section 2(x)).

Data Processors may be of two types:

• Upstream processors collect data on behalf of a business. For example, a company hires a marketing agency to run a sign-up campaign. The agency collects the customer details and shares them with the company, but the company decides what data will be collected and what it will be used for.
• Downstream Data Processors process the data after a company has collected it. For example, the same company may engage a payroll provider to handle employee salaries. The payroll provider processes the data, but the company instructs it on how to do so.

In both cases, the company is responsible for giving notice and collecting consent as per Sections 5 and 6 of the DPDP Act.

What are the obligations of Data Processors under the DPDP Act?

The DPDP Act does not place any specific obligations on Data Processors. All obligations, including security, breach reporting and erasure, are placed on the Data Fiduciary.

A Data Fiduciary is responsible for complying with the Act for any processing done on its behalf by a Data Processor including any violations by the Data Processor. So if a Data Processor causes a breach, the Data Fiduciary can be penalised for it, even if the contract between them says otherwise. A business cannot pass its legal responsibility to a vendor by signing an agreement.

Can a Data Processor become a Data Fiduciary?

Yes, and the test is simple. Ask who decides why the data is used and how. If the Data Processor starts making those decisions, it is no longer following instructions. It has become a Data Fiduciary for that use.

What changes once a Data Processor becomes a Data Fiduciary?

All the obligations of a Data Fiduciary now apply to it for that use, and it can be held responsible for any violations. These include:

• Processing data only for a lawful purpose, i.e. consent or a legitimate use (Section 4).
• Giving notice to the Data Principal before asking for consent (Section 5).
• Taking reasonable security safeguards and reporting breaches (Section 8).
• Erasing data when consent is withdrawn or the purpose is served (Section 8(7)).

What safeguards should a Data Fiduciary have in place when sharing data with a Data Processor?

While Data Processors do not have any obligations under the Act, in practice the Data Fiduciary's duties have to be carried out by its Data Processors. To protect itself, a Data Fiduciary can take the following measures:

• Run checks on each Data Processor before engaging them.
• Enter into a Data Processing Agreement (mandated under the DPDP Act).
• Have reasonable security safeguards in place.
• Make sure the Data Processor stops processing and erases or retains data when required.

What checks should you run before hiring a Data Processor?

• Check security credentials and track record: Look for recognised certifications such as ISO/IEC 27001. Ask about past breaches and audit reports.
• Understand the data flow: Know what data the Data Processor will receive, where it will be stored and who will have access. Also ask about subcontractors at onboarding.
• Minimise data sharing: Share only what the vendor actually needs to perform its function and tokenise personal data where you can. 
• Try to keep data on your own systems: When integrating with a vendor, try to have them operate within your interface rather than their own so that you can control the data. This isn't always achievable — but wherever it is, it should be the default. 
• Audit regularly: Use independent audits and penetration testing to check that the Data Processor follows what the contract says.
• Run a breach drill: Test how quickly the Data Processor can alert you and how quickly you can reach the Board and affected people.

What should a Data Processing Agreement cover?

A Data Processor can process personal data on behalf of a Data Fiduciary only under a valid contract as per Section 8(2). This contract is typically called a Data Processing Agreement (DPA) and should include the following provisions:

1. Security safeguards: Your DPA should include a provision on security safeguards as per Rule 6(1)(f) of the DPDP Rules and should include the measures under Rule 6 and any additional standards the business wants.
2. Roles and instructions: Specify who is the Data Fiduciary and who is the Data Processor. Also describe what the Data Processor will do, what data is processed and how long it can be retained.
3. Breach notification: Require the Data Processor to report a breach to the Data Fiduciary within a fixed and short window, as the Data Fiduciary has to report within 72 hours.
4. Support for Data Principal requests: The Data Processor must help the Data Fiduciary respond to requests to access, correct or erase data, to withdraw consent, and to raise grievances.
5. Deletion and return of data and logs: State what happens to data when consent is withdrawn or purpose is completed, including backups and archives. Specify which data and logs must be kept for the minimum periods set out under the Act. 
6. Sub-processors: The Data Processor must not share data with any other company without the Data Fiduciary's prior approval. 
7. Transfers outside India: Set out any restrictions on whether data can be sent or stored outside India, and on what conditions. 
8. Audit and inspection rights: Have provisions allowing you the right to audit the Data Processor, or to ask for audit reports.
9. Indemnity and liability: State who bears the cost if the Data Processor's failure leads to a breach, a penalty or a claim. 
10. Exit: Cover what happens when the contract ends, including how data is returned or erased and how the Data Processor confirms it.

What are reasonable security safeguards?

A Data Fiduciary must protect personal data in its possession or under its control, including data handled by its Data Processor. Rule 6 of the DPDP Rules lays out the minimum standards, including:

• Encryption, masking or similar measures to secure the data.
• Controls on who can access the systems that hold it.
• Logs, monitoring and review, so that unauthorised access can be detected and investigated.
• Data backups, so that processing can continue if data is lost or damaged.
• Retention of logs and personal data for one year, unless another law requires otherwise.
• A clause in the contract with the Data Processor covering security safeguards.

A breach of this duty can lead to a penalty of up to ₹250 crore.

How should a Data Fiduciary ensure the Data Processor erases or retains data when required?

A Data Fiduciary must ensure that its Data Processor stops processing and erases personal data when the Data Principal withdraws consent, or once the purpose is no longer being served as per Sections 6(6) and 8(7). If retention of logs for any purpose is required, the Fiduciary must retain them for the required period.

To make this work in practice, businesses should:

• Automate instructions to vendors: Whenever a data subject request is raised including withdrawal of consent, deletion, access, correction, your system should automatically send instructions to every relevant vendor with defined deadlines. 
• Require acknowledgement from vendors: Have systems in place to ensure that vendors confirm completion back to you so you can track compliance across all third parties.
• Run sample audits: Run sample audits to check if data has actually been deleted.

Next steps

Start with a list of every Data Processor that holds your data. Then audit them to check that each one has a written contract and checks that cover the points above.

Consentin helps businesses manage consent, data lifecycle and third-party risk in one place. Book a demo to see how it works.

FAQs

What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides the purpose and means of processing personal data (Section 2(i)). A Data Processor processes personal data on behalf of a Data Fiduciary (Section 2(k)). The Data Fiduciary makes the decisions. The Data Processor follows its instructions.

Is a Data Processor liable under the DPDP Act?
The Act places its obligations on the Data Fiduciary, who is responsible for processing done on its behalf by a Data Processor (Section 8(1)). A Data Processor's liability usually comes from its contract with the Data Fiduciary, such as an indemnity clause. 

Is a contract required to hire a Data Processor?
Yes. A Data Fiduciary can engage a Data Processor for any activity related to offering goods or services to Data Principals only under a valid contract (Section 8(2)). 

Can a Data Processor become a Data Fiduciary?
Yes. If a Data Processor decides the purpose or means of processing for any use of the data, it becomes a Data Fiduciary for that use and must follow all Data Fiduciary obligations.

Does a Data Processor need to take consent from Data Principals?
Even if the Data Processor is processing data, notice and consent obligations are the Data Fiduciary's responsibility. If the Data Processor wants to use the data for its own purpose, it must obtain its own consent or rely on a legitimate use.

What must a Data Processor do if there is a personal data breach?
The Act requires the Data Fiduciary to inform the Board and affected Data Principals (Section 8(6), Rule 7). The Data Processor should inform the Data Fiduciary immediately, as the contract requires, so the Data Fiduciary can meet its own deadlines.

How long must personal data and logs be kept?
A Data Fiduciary must retain personal data, traffic data and logs of processing for at least one year from the date of processing, including processing done by its Data Processor. After that they must be erased, unless another law requires longer retention (Rule 8(3)).

Does the DPDP Act apply to Data Processors outside India?
The Act applies to processing outside India if it is connected to offering goods or services to Data Principals in India, so foreign Data Processors processing data for an Indian business will also be covered. 

Who is a Significant Data Fiduciary? 

A Significant Data Fiduciary is an entity notified by the Central Government under Section 10 as one. This may be a Data Fiduciary, or a class of Data Fiduciaries, and they have some additional obligations under the Act. They may also engage Data Processors to process their data.