Data Processing Agreements Under the DPDP Act

Last updated: 20 August 2026

A data processing agreement (DPA) is a contract that governs how one party processes personal data on behalf of another — for example, a cloud or SaaS provider processing data for a business customer. It sits alongside the main commercial contract and allocates the data protection responsibilities.

What the DPDP Act requires

Under India’s Digital Personal Data Protection Act, 2023, a Data Fiduciary may engage a Data Processor to process personal data only under a valid contract (section 8(2)). The Data Fiduciary remains responsible for compliance with the Act, including for processing carried out on its behalf (section 8(1)) — see Obligations of a Data Fiduciary. A DPA is how that contractual requirement is met in practice.

What the GDPR requires (where it applies)

Where the GDPR applies, Article 28 requires a written contract between the controller and the processor. Among other things, that contract must bind the processor to:

process personal data only on the controller’s documented instructions;
ensure that persons authorised to process the data are under a duty of confidentiality;
implement appropriate security measures;
not engage a sub-processor without the controller’s authorisation;
assist the controller with data subject rights, security, breach notification and impact assessments;
delete or return the personal data at the end of the services; and
make available information needed to demonstrate compliance, and allow audits.

The contract also records the subject matter and duration of the processing, its nature and purpose, and the types of personal data and categories of individuals involved.

In practice

A DPA typically reflects these requirements, adjusted to the framework(s) that apply to the parties. A business that both handles Indian personal data and offers services into the EU may need a DPA that addresses both regimes. This page is a general overview and is not legal advice.