You Are a Processor: What the DPDP Act Means for Vendors

Introduction

Much DPDP guidance is written for the business that hires vendors. This article is for the vendor: the SaaS company, BPO, cloud host, payroll bureau or analytics agency that handles personal data because a client asked it to.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) calls that client the data fiduciary: any person who, alone or with others, "determines the purpose and means of processing of personal data" (s.2(i)). The vendor is a data processor: "any person who processes personal data on behalf of a Data Fiduciary" (s.2(k)). The data principal is the individual the data is about. The main obligations commence on 13 May 2027.

Trayambic's vendor-contracts checklist covers the clauses from the client's side. Here we ask what the Act demands of processors, where their exposure lies and what clients will ask them to prove.

The legal position

Section 8(1) makes the fiduciary responsible for compliance "irrespective of any agreement to the contrary", including for processing done "on its behalf by a Data Processor". Section 8(2) lets a fiduciary "engage, appoint, use or otherwise involve" a processor "only under a valid contract".

We searched the Act for every use of the term. It appears in seven provisions, and in each the duty sits with the fiduciary.

The term does not appear in s.8(6) on breach intimation, the s.17 exemptions, s.33 on penalties or the Schedule. The DPDP Rules, 2025 mention processors in Rule 6 (access control over their computer resources; security terms in the contract) and Rule 8(3) (logs of processing on the fiduciary's behalf), again as the fiduciary's duty.

Analysis

Can the Board penalise a processor?

Section 33(1) lets the Data Protection Board penalise a significant breach of the Act or Rules "by a person". But a penalty needs a breached provision. Item 1 of the Schedule is the "obligation of Data Fiduciary" to take security safeguards; item 2 is the breach-notice duty, which s.8(6) places on the fiduciary. The residual item, "any other provision", still needs a provision binding the processor, and we have found none. The Board may inquire into a personal data breach on a complaint (s.27(1)(b)) wherever it happened, but the penalty attaches to the duty breached.

In our view, consistent with Trayambic's SaaS and IT services study, a processor acting within instructions has little direct DPDP penalty exposure; its exposure is mainly contractual. Four routes still reach it:

1. 1.Becoming a fiduciary, discussed below.
2. 2.The Board's civil-court powers (s.28(7)) to summon and examine any person and inspect any data, so a vendor can be questioned in its client's inquiry.
3. 3.The IT Act. Section 72A reaches "any person including an intermediary" who, while serving under a lawful contract, discloses personal information without consent or in breach of contract. Secondary sources say the Jan Vishwas (Amendment of Provisions) Act, 2023 replaced its prison term with a penalty of up to ₹25 lakh. Until 13 May 2027, s.43A compensation also reaches a body corporate "handling" sensitive personal data negligently, as Trayambic's Insight on the SPDI Rules explains.
4. 4.CERT-In, whose Directions bind service providers and body corporates directly.

When the vendor becomes a fiduciary

The test in s.2(i) is functional. A vendor that sets its own purpose for client data is a fiduciary for that processing, whatever the contract says. "In conjunction with" also catches shared decisions: an analytics agency that designs a segmentation model with one client and reuses it for others is, in our view, deciding purposes too.

Model training is the commonest crossing. Training a model offered to all customers on one customer's content is the vendor's own purpose, so, as Trayambic's article on training AI explains, it needs its own ground for each person: usually consent naming that purpose, or genuine anonymisation. Our SaaS study lists others, such as lead harvesting.

Crossing brings the whole Act to bear, and usually breaches the client contract too.

Sub-processors

A sub-processor also processes "on behalf of a Data Fiduciary", so in our view it is itself a processor under s.2(k), which the client must "otherwise involve" under a valid contract. The vendor therefore needs the client's authority before adding one, terms that flow down, and a current list, because the client's s.11(1)(b) response must identify processors the data reached.

Bank clients go further. The RBI's Managing Risks in Outsourcing Directions for commercial banks (28 November 2025) require the bank's prior approval of sub-contractors in IT outsourcing agreements (paras 34(iv) and 69), make the provider liable for them (para 69(xiii)) and let the RBI inspect them (para 69(xii)).

Incidents: the client's clock is yours

Only the fiduciary notifies the Board and affected people: without delay, then a detailed report within 72 hours of becoming aware (Rule 7). In Trayambic's view that clock runs from the fiduciary's awareness, but a vendor that sits on an incident delays it only on paper; the Board may count from when the client ought to have known.

Some clocks start at the vendor. Under para 56 of the RBI's commercial-bank outsourcing directions, and para 61 of the NBFC version, the regulated entity must report a cyber incident to the RBI "within six hours of detection by the service provider". A vendor that takes four hours to call the bank leaves it two.

CERT-In adds a duty of the vendor's own: any entity that notices an incident must report it within six hours and cannot pass the duty to its client (FAQ Q13), whatever the contract's confidentiality clause says (Q22). Vendor and client may both file, so their facts should match. Trayambic's framework "One Incident, Many Clocks" maps every clock.

Deletion certificates

Sections 6(6) and 8(7)(b) put the duty on the client, but only the vendor can perform it, person by person as well as tenant by tenant, including withdrawals relayed by consent managers, which can register from 13 November 2026.

A certificate is evidence, not a statutory form, so it should claim only what is true: production data deleted on a stated date, backups expiring on rotation by a stated date, sub-processors' confirmations, and what is kept and why. Common exceptions are the vendor's CERT-In logs (180 days), its tax records and any one-year Rule 8(3) set the client asked it to hold. Banks must contract for "safe removal or destruction of data" (para 82) and, on a cloud exit, independent assurance after purging (para 92(xvi)(d)). Trayambic's retention whitepaper covers the client's side.

Audits

Banks audit providers and sub-contractors (para 71) and need "unrestricted and effective access" to data and premises (para 76). A client designated a Significant Data Fiduciary (SDF) must have an independent data auditor and an annual audit (s.10(2); Rule 13), and in our view that audit will test its processors. One reusable audit pack, such as an ISO/IEC 27001 certificate or an independent report mapped to Rule 6, answers most requests without a site visit. When auditors come, hold them to CERT-In's July 2025 audit guidelines: auditee data kept on systems in India, encrypted and wiped with a certificate (para 10.3).

Foreign clients and s.17(1)(d)

Most of the Act does not apply where data of people "not within the territory of India" is processed under a contract "with any person outside the territory of India by any person based in India". Sections 8(1) and 8(5) survive; in our view they formally bind the foreign client as fiduciary, but the vendor runs the safeguards, and CERT-In applies regardless. Trayambic's GCC and BPO study sets out the exemption's conditions and what breaks them.

Practical implications

Worked example: an HR-SaaS vendor serving a bank and a hospital

Facts and figures are illustrative. A Chennai HR-SaaS company with 150 staff runs HR, payroll and attendance for a private bank (14,000 employees) and a 700-bed hospital (4,000 staff). Its plan for May 2027:

1. 1.Role map. Processor for both clients' staff data; fiduciary for its own staff, trial users and sales contacts. Sales wants to e-mail the hospital's doctors, from HR records, about a new locum-shift product. Refused: that would make the company a fiduciary with no ground.
2. 2.The s.8(2) wording. Section 8(2) speaks of processors used for activity "related to offering of goods or services to Data Principals", which staff payroll is not obviously. In our view that does not bar HR outsourcing: s.8(1) covers any processing by a processor, and a literal reading would stop employers using payroll bureaux at all.
3. 3.The bank. It treats payroll as material IT outsourcing (para 53(2)). The company accepts storage in India, RBI inspection, prior approval of a new AI help-desk model provider, and an alert within two hours of detection, leaving the bank time for its six-hour RBI report.
4. 4.The hospital. It has no RBI-style clock, but staff vaccination and needle-stick records sit in an occupational-health module with narrower access. The same two-hour alert applies: one standard is easier to meet.
5. 5.Incidents and exit. The company files its own CERT-In report within six hours and shares the reference. On exit it deletes production data within 30 days and backups within 35, and certifies it, listing its 180-day CERT-In logs as the exception.

Processor readiness pack

Key takeaways

The DPDP Act regulates processors through their clients, so the client contract is the processor's working compliance regime, backed by CERT-In and the IT Act. Vendors that stay inside instructions, alert within hours, delete on demand and can prove it will win renewals; those that reuse client data for themselves become fiduciaries.

• The DPDP Act names processors in ss.2(k), 6(6), 8(1), 8(2), 8(5), 8(7)(b) and 11(1)(b); in every case the duty falls on the data fiduciary.
• In our view a processor acting within instructions has little direct penalty exposure, but CERT-In, IT Act s.72A, s.43A until May 2027 and the Board's summoning powers still reach it.
• A vendor that uses client data for its own purposes, including model training, becomes a fiduciary for that processing.
• RBI clients must report incidents within six hours of detection by the service provider, so vendor alerts must be measured in hours; CERT-In reporting is the vendor's own duty.
• A readiness pack of role map, DPA, sub-processor list, incident runbook, deletion certificate and audit evidence answers most client demands.