Vendor Contracts for SaaS and GCCs: A DPDP Checklist
Under the DPDP Act the business that hires a vendor answers for the vendor's mistakes, so the contract is where SaaS companies and global capability centres manage most of their risk.
- CATEGORY
- Blog post · SaaS
- POSITION AS OF
- October 2026
- READING TIME
- 4 min read
- TAGS
- SaaS, GCCs, Data processors, Cross-border transfers
A Bengaluru SaaS company usually plays three parts at once. It decides how to use its own customers' account and billing data. It handles the end-user data its clients upload, on their instructions. And it hires its own suppliers, from cloud hosting to a support desk in Manila. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), each part comes with a different set of contract terms, and getting the parts confused is the most common drafting mistake.
Three roles, three contract positions
The Act calls the party that decides the purpose and means of processing a data fiduciary, and a party acting on its behalf a data processor. Section 8(1) holds the fiduciary responsible for compliance "irrespective of any agreement to the contrary", including for what its processors do. Section 8(2) permits a fiduciary to engage a processor only under a valid contract.
| Clause | Where you are the vendor (processor) | Where you are the client (fiduciary) |
|---|---|---|
| Scope of use | Accept limits to the client's instructions; carve out your own account data | Limit the vendor to your instructions (ss.8(1), 8(2)) |
| Security | Commit to the Rule 6 minimums you actually run | Require the Rule 6 minimums: encryption or masking, access control, logging, backups |
| Incidents | Offer a notice window you can meet | Set a window measured in hours, not "promptly" (s.8(6); Rule 7) |
| Logs | Keep at least one year | Require at least one year (Rule 6) |
| End of contract | Agree deletion and certification | Require deletion; s.8(7)(b) obliges you to make the vendor erase |
| Onward vendors | List your sub-processors | Approve sub-processors; same terms to apply |
The incident clause is where most templates fall short. Under Rule 7, the fiduciary must inform affected individuals and the Data Protection Board without delay and send the Board a detailed report within 72 hours. A vendor that tells its client on day three has used the whole window. Separately, CERT-In's Directions of 28 April 2022 require cyber incidents to be reported to CERT-In within six hours, so the timelines must be read together.
Where the data can go
For a regulated client, sector rules decide more than the DPDP Act does.
- Payments. The RBI's circular of 6 April 2018 requires payment system data to be stored only in India.
- Banking outsourcing. The RBI's "Managing Risks in Outsourcing" Directions of 28 November 2025 require data to be stored only in India where applicable. Existing contracts had to comply by renewal or 10 April 2026, whichever came first.
- Securities. SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 requires regulated entities to keep a copy of their data in India.
The DPDP Act itself is permissive. Under section 16(1), transfers abroad are allowed except to countries the Central Government restricts by notification, and we found no such notification as of October 2026. Rule 15 adds that transfers must meet any requirements the government sets by order about making data available to foreign states. Section 16(2) expressly preserves stricter sector laws, which is why the list above still governs regulated work.
Trade agreements do not change this yet. The India–UK Comprehensive Economic and Trade Agreement, in force since 15 July 2026, has a digital trade chapter, but it does not oblige India to permit data flows to the UK now.
A worked example: a GCC with mixed data
A US retailer's global capability centre in Hyderabad runs analytics on US shoppers' data under a services agreement with its parent. It also runs payroll for its 2,000 Indian staff and, since last year, a loyalty programme for the parent's new Indian stores.
Section 17(1)(d) exempts processing of personal data of people outside India under a contract with a person outside India. For that processing, most of the Act falls away: Chapter II except sections 8(1) and 8(5), Chapter III and section 16. So the US shopper analytics still needs reasonable security safeguards, but not notices, consent records or rights handling under the Act.
The payroll and the Indian loyalty data get no such relief. Both are fully within the Act. The GCC therefore keeps the US analytics environment separate from systems holding Indian data, tags each dataset by jurisdiction, and applies Indian notices, rights processes and retention rules only where they belong.
Five steps for this quarter
- Mark your role on each data flow: fiduciary, processor or both.
- Prepare two templates, one for when you buy services and one for when you sell them, built from the table above.
- Fix the incident window in hours in every contract.
- Flag regulated clients whose sector rules keep data in India.
- For GCCs, tag data by jurisdiction before relying on section 17(1)(d).
The Act's main obligations commence on 13 May 2027. Enterprise contracts often run for three years, so the terms signed now will be the ones in force when the Board starts work.
Key takeaways
- The data fiduciary is responsible for its processors; obligations reach processors mainly through contracts.
- Contracts should fix an incident-notice window in hours, to support the 72-hour Board report and CERT-In's six-hour rule.
- Section 16 restricts transfers only to notified countries, and none had been notified as of October 2026.
- Sector rules from the RBI and SEBI still require some data to stay in India.
- Section 17(1)(d) relieves GCCs of most duties for non-residents' data under foreign contracts, but security safeguards still apply and Indian data is fully covered.
The DPDP Act in 15 Terms: A Plain-Language Glossary
Fifteen of the 28 definitions in section 2 of the DPDP Act decide whether your data is covered, who carries the duty and what counts as a breach.
Your First DPDP Task: A Data Inventory in Two Weeks
The DPDP Act never asks for a data inventory, yet notices, access requests, erasure, breach scoping and proof of consent all depend on one.
Run a Breach Tabletop Exercise Before May 2027
A 90-minute scripted drill, with injects from the first email to the 72-hour Board report, will show where your breach plan breaks before a real incident does.