DPDP processor contracts: what must be in them

Under this framework the processor contract is not paperwork; it is the legal mechanism through which most of your duties reach the vendor.

The two explicit anchors

"A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract."

No valid contract, no lawful engagement. And Rule 6 makes the contract itself a safeguard: the listed minimums include appropriate provisions in the fiduciary to processor contract for taking reasonable security safeguards.

What your own duties push into the contract

Responsibility for compliance stays with you irrespective of any agreement to the contrary, which is precisely why the contract must make the processor deliver what you owe. Three flows matter most. Erasure: when your erasure duties bite, you must cause the processor to erase the data you made available, so the contract needs an erasure on instruction clause with timelines. Log retention: the one year retention of data, traffic data and logs reaches processing done on your behalf, and the rule's own illustration has the fiduciary ensuring its cloud provider keeps them. Breach: the intimation duties to individuals and the Board are yours and run on short clocks, so the contract should fix detection, notification to you, and cooperation within hours, not business days.

Cross border room

If the processor is offshore, leave contractual room for government orders on making data available to foreign states and for notified country restrictions.

What to do

Work each engagement through the vendor and processor checklist; it maps every clause here to the exact provision. The Act text is at Section 8.