Data Protection Policy Template India

DATA PROTECTION POLICY AND PRIVACY COMPLIANCE AGREEMENT

This Data Protection Policy and Privacy Compliance Agreement (the "Agreement") is entered into as of this [Day] day of [Month], [Year] (the "Effective Date"), by and between:

[Company Name], a company incorporated under the laws of India, having its registered office at [Registered Address] (hereinafter referred to as the "Data Controller");

AND

[Counterparty/Vendor Name], a company incorporated under the laws of [Jurisdiction], having its registered office at [Registered Address] (hereinafter referred to as the "Data Processor").

Collectively referred to as the "Parties" and individually as a "Party."

RECITALS

WHEREAS, the Data Controller possesses certain personal and sensitive data of Indian residents and requires the Data Processor to process such data in the course of business operations;

WHEREAS, the Parties seek to align their data processing activities with the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and applicable information technology laws of India;

NOW, THEREFORE, in consideration of the mutual covenants and agreements herein contained, the Parties agree as follows:

---

1. OPERATIONAL DEFINITIONS

1.1 "Data Principal" shall have the meaning ascribed to it under the DPDP Act, being the individual to whom the Personal Data relates.

1.2 "Personal Data" means any data about an individual who is identifiable in relation to such data.

1.3 "Processing" means an automated operation or set of operations performed on Personal Data, including collection, storage, use, or disclosure.

1.4 "Sensitive Personal Data" means such categories of data as may be notified by the Government of India under the DPDP Act or under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1.5 "Breach" means any unauthorized processing of Personal Data or accidental disclosure, acquisition, alteration, or destruction of Personal Data.

---

2. SUBSTANTIVE TERMS AND OBLIGATIONS

2.1 Lawful Processing: The Data Processor shall process Personal Data only upon documented instructions from the Data Controller and for the specific purpose(s) identified in [Schedule A].

2.2 Security Safeguards: The Data Processor shall implement appropriate technical and organizational measures to ensure security, including, but not limited to, encryption, pseudonymization, and regular security audits to prevent data leakage.

2.3 Data Minimization: The Data Processor shall ensure that only the minimum amount of Personal Data necessary to fulfill the defined purpose is collected or processed.

2.4 Sub-processing: The Data Processor shall not engage any third-party sub-processor without the prior written consent of the Data Controller. Any sub-processor must be bound by contractual obligations at least as restrictive as those contained herein.

2.5 Data Subject Rights: The Data Processor shall provide reasonable assistance to the Data Controller to enable the Data Controller to fulfill its obligations to respond to requests from Data Principals exercising their rights under the DPDP Act.

---

3. DEFAULT, TERMINATION, AND REMEDIES

3.1 Breach Classification: A breach of this Agreement, specifically involving a failure to secure Personal Data or unauthorized cross-border transfer, shall be deemed a "Material Breach."

3.2 Cure Period: In the event of a non-material breach, the non-breaching Party shall provide written notice of such breach. The breaching Party shall have thirty (30) business days from the receipt of such notice to cure the breach to the reasonable satisfaction of the non-breaching Party.

3.3 Termination for Cause: The Data Controller reserves the right to terminate this Agreement immediately upon written notice if the Data Processor fails to remedy a Material Breach within the Cure Period or commits a breach that is incapable of remedy.

3.4 Remedies: The Data Processor shall indemnify and hold harmless the Data Controller from all liabilities, fines, or damages arising out of the Data Processor’s non-compliance with the DPDP Act, capped at [Dollar Amount/Rupee Amount] unless the breach resulted from gross negligence or willful misconduct.

---

4. BOILERPLATE LEGAL PROVISIONS

4.1 Severability: If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue to be valid and enforceable to the fullest extent permitted by law.

4.2 Entire Agreement: This Agreement constitutes the entire understanding between the Parties concerning the subject matter hereof and supersedes all prior agreements or negotiations.

4.3 Force Majeure: Neither Party shall be liable for failure to perform its obligations if such failure results from an event beyond its reasonable control, including acts of God, war, or governmental regulation.

4.4 Governing Law: This Agreement shall be governed by and construed in accordance with the laws of India.

4.5 Dispute Resolution: Any dispute arising out of this Agreement shall be settled through binding arbitration in [City, India] in accordance with the Arbitration and Conciliation Act, 1996. The language of arbitration shall be English.

---

5. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

For and on behalf of [Company Name] (Data Controller):

Signature: ___________________________ Name: _______________________________ Title: ________________________________ Date: ________________________________

For and on behalf of [Counterparty Name] (Data Processor):

Signature: ___________________________ Name: _______________________________ Title: ________________________________ Date: ________________________________