data processing agreement template india

Data Processing Agreement

Instructions for Use

• Fill in all bracketed information [__________] with the specific details of the Data Controller and Data Processor.
• Ensure the "Description of Processing" section is completed with technical specificity regarding the nature, scope, and duration of the data handling.
• Execute this document as an addendum to your primary Master Services Agreement or Service Contract to ensure the underlying commercial terms remain enforceable.

Parties and Definitions

This Data Processing Agreement ("DPA") is entered into on [Date] by and between:

Data Controller: [Full Legal Name of Controller], having its principal place of business at [Full Address of Controller] ("Controller").

Data Processor: [Full Legal Name of Processor], having its principal place of business at [Full Address of Processor] ("Processor").

Definitions: "Personal Data" means any information relating to an identified or identifiable natural person. "Applicable Data Protection Laws" means the Digital Personal Data Protection Act, 2023 (DPDP Act) and any other applicable Indian laws or regulations governing the processing of personal data.

Operative Terms

1. Scope of Processing: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions of the Controller. The Processor shall not process Personal Data for any other purpose.

2. Compliance with DPDP Act: Both parties agree to comply with the requirements of the Digital Personal Data Protection Act, 2023. The Processor shall assist the Controller in ensuring compliance with obligations related to data accuracy, security safeguards, and breach notification.

3. Data Security: The Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

4. Sub-processors: The Processor shall not engage any third-party sub-processor without the prior written authorization of the Controller. The Processor remains fully liable to the Controller for the performance of any sub-processor’s obligations.

5. Data Subject Rights: The Processor shall, to the extent legally permitted, promptly notify the Controller if it receives a request from a Data Subject to exercise their rights under applicable law and shall provide reasonable assistance to the Controller in responding to such requests.

6. Data Breach Notification: The Processor shall notify the Controller without undue delay (and in no event later than [Number] hours) after becoming aware of a personal data breach.

7. Term and Termination: This DPA shall remain in effect for the duration of the underlying services agreement. Upon termination, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller.

8. Governing Law: This DPA shall be governed by and construed in accordance with the laws of [State/Union Territory], India. Any disputes shall be subject to the exclusive jurisdiction of the courts in [City].

Signature & Acknowledgment

For and on behalf of the Controller: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

For and on behalf of the Processor: Signature: __________ Printed Name: [Name] Title: [Title] Date: [Date]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this agreement satisfies your specific operational requirements and current regulatory compliance obligations in India.