What Is a Data Processor Under the DPDP Act? A Vendor-Evaluation Checklist for BFSI
Under India’s DPDP Act, a data processor is any person that processes personal data on behalf of a data fiduciary. The processor acts only on the fiduciary’s instructions. Learn key DPA terms and BFSI vendor compliance rules.
Under India’s DPDP Act, a data processor is any person that processes personal data on behalf of a data fiduciary. The processor acts only on the fiduciary’s instructions. It does not decide why or how data is processed. The fiduciary remains legally responsible for compliance. A bank or NBFC must engage each processor under a valid contract, typically covering security safeguards, breach notice, and audit terms.
- A data fiduciary remains accountable for personal data handled by its vendors under the DPDP Act, even if a contract says otherwise.
- The DPDP Rules require security terms in vendor contracts, plus a 72-hour fiduciary breach notice deadline.
- Experts disagree on whether the Board can fine processors directly; fiduciary exposure is clear in statute.
- The Reserve Bank of India requires banks and NBFCs to align IT contracts with 2025 Directions by 10 April 2026 or renewal.
Data Fiduciary vs. Data Processor: Who Decides What
Understanding who controls processing purpose versus who executes technical tasks.
The main divide between a fiduciary and a processor is who decides why and how data gets processed.
Under Section 2 of the DPDP Act, a data processor is defined as any person who processes personal data on behalf of a data fiduciary. The processor does not pick the purpose or means of processing. It simply carries out instructions from the fiduciary. For banks and NBFCs, common processors include cloud hosts, payment gateways, KYC vendors, and payroll providers.
Operational roles can vary. As KS&K’s practical scenarios illustrate, a KYC vendor that runs checks for a fintech and a cloud provider that stores its data are both processors, though they sit at different points in the data flow. However, legal classification depends on who determines the purpose and means of processing. If a vendor begins deciding why or how customer data is used, it risks being treated as a data fiduciary. That shift triggers full fiduciary duties, including notice, consent capture, and direct regulatory accountability.
Statutory Duties and the Contract Mechanism
Section 8(1) non-delegable responsibility and Rule 6(f) security safeguards.
Under the DPDP Act, a processor’s duties flow through its contract with the fiduciary rather than standalone statutory rules.
Section 8 of the DPDP Act anchors third-party processing. Section 8(1) states that a data fiduciary remains responsible for complying with the Act for all processing done on its behalf, irrespective of any agreement to the contrary. In addition, Section 8(2) states that a fiduciary may only engage a processor under a valid contract.
“Under Section 8(1), a fiduciary remains responsible for compliance and for its processor's actions even if the contract says otherwise. Accountability runs through the contract.”
Commentary from KS&Kpoints out that India’s DPDP Act places limited direct statutory liability on processors. Accountability stays with the fiduciary. KS&K outlines five core duties that fiduciaries build into vendor contracts:
- Documented instructions: Process personal data strictly on documented instructions.
- Technical safeguards: Put in place reasonable technical and operational safeguards.
- Sub-processor consent: Never engage sub-processors without prior written consent.
- Rights assistance: Assist the fiduciary with rights requests and breach inquiries.
- Record keeping & deletion: Keep processing records and delete or return data when work ends.
Security and breach rules reinforce this contract link. Under Rule 6(f) of the DPDP Rules, the contract must mandate that the processor implement reasonable security safeguards. For incidents, Rule 7 requires the fiduciary to notify the Data Protection Board within 72 hours of finding a breach. Because the law sets no numeric deadline for a vendor to report to its fiduciary, contracts routinely require immediate notice, often within 24 hours. Agreements should also require written proof that data is purged when work finishes.
What a Data Processing Agreement Should Include
Eight core terms, sub-processor lacunae, and regulatory penalty exposure.
A Data Processing Agreement sets the operational and security rules that bind a vendor to the fiduciary.
Guidance from Atlas Systems outlines eight essential clauses for DPDP vendor contracts:
1. Scope and purpose
Sets permitted processing tasks and bars secondary data use.
2. Security safeguards
Mandates technical controls matched to data sensitivity.
3. Breach notice
Requires rapid incident reporting (e.g. 24h) to the fiduciary.
4. Audit rights
Permits the fiduciary to inspect security logs and conduct audits.
5. Sub-processor controls
Bars downstream delegation without prior written approval.
6. Rights assistance
Requires vendor support for customer access and erasure requests.
7. Data deletion
Governs data purging at contract end, backed by written proof.
8. Liability & indemnity
Allocates financial exposure if vendor faults cause regulatory fines.
Contract teams should also address statutory gaps. Analysis from AMLEGALS highlights that the DPDP Act does not directly regulate sub-processors or set standard terms for cross-border processors. AMLEGALS calls the sub-processor silence a contractual lacuna. To close these risks, contracts should use flow-down terms, keep an updated vendor list, and hold the primary processor liable for all sub-vendor actions.
Regulatory penalty exposure also requires care. Legal commentators disagree on whether the Board can fine processors directly. An analysis from KS&K argues that Board powers under Section 33 cover fiduciaries and processors alike. Conversely, commentary from Consent.in states that the Board cannot penalize processors directly, leaving liability solely with the fiduciary. While this dispute remains open, a fiduciary faces fines up to ₹250 crore under Section 8(5) for security failures, an exposure it cannot contract away.
A Seven-Step Vendor Evaluation Checklist for BFSI
Practical operational steps aligning DPDP privacy and RBI IT outsourcing directions.
Evaluating a vendor requires financial firms to review technical safeguards alongside contract terms.
Inventory vendors
List all third parties handling personal data and classify them by data risk.
Sign a DPA
Ensure a dedicated Data Processing Agreement sits alongside the service contract.
Map data flows
Record what data the vendor touches, where it sits, and who has access.
Review security audits
Check external reports like ISO 27001 or SOC 2 Type II as supporting proof.
Set deletion steps
Require clear purging runbooks, backed by written certificates of destruction.
Define SLA response times
Fix tight windows for helping with customer rights requests.
Run ongoing checks
Treat vendor oversight as a routine cycle with regular periodic reviews.
For regulated entities, DPDP reviews must align with Reserve Bank of India rules. Analysis from Vinod Kothari Consultantsoutlines the Reserve Bank of India’s 2025 Outsourcing Directions for banks and NBFCs. Both instruments demand continuous due diligence across operational, financial, and legal factors. They ban commingling customer records with other client files, demand a strict need-to-know access model, and extend inspection rights to material sub-contractors. Existing IT outsourcing contracts must meet the 2025 Directions upon contract renewal or by 10 April 2026, whichever comes first.
Data Fiduciary vs. Data Processor at a Glance
Side-by-side comparison across statutory duties, penalty exposure, and breach reporting.
The line between a data fiduciary and a data processor sets who answers to the regulator and who answers through a contract.
| Dimension | Data Fiduciary | Data Processor |
|---|---|---|
| Processing decisions | Decides the purpose and means of data use | Processes data only on instructions from the fiduciary |
| Statutory accountability | Directly accountable to the Data Protection Board | Limited direct statutory liability; duties flow through contract |
| Origin of duties | Bound directly by the DPDP Act and Rules | Bound by the terms of the Data Processing Agreement |
| Contracting duty | Must engage processors only under a valid contract | Cannot lawfully process data without a valid contract |
| Penalty exposure | Liable up to ₹250 crore for security failures under Section 8(5) | Contractual liability to fiduciary; direct Board fines remain disputed |
| Breach reporting | Must notify the Board within 72 hours of discovery | No statutory reporting deadline; governed by contract terms |
| Data deletion | Governed by statutory retention and erasure rules | Must return or delete data upon instruction or contract end |
What This Means for BFSI Vendor Contracts
Closing the gap between privacy compliance and banking outsourcing mandates.
For banks and NBFCs, DPDP processor rules and Reserve Bank of India outsourcing rules create two overlapping layers that contracts must satisfy together.
Read together, these rules point to a common blind spot in vendor onboarding. A contract that meets standard DPDP privacy clauses can still breach Reserve Bank of India rules if it omits terms on data commingling, ongoing due diligence, or sub-contractor audit rights. Likewise, an older IT vendor contract may satisfy banking rules but lack Rule 6(f) security terms or standard DPA provisions on breach notice and customer rights assistance.
“How a vendor labels itself in sales talks does not fix your legal exposure. Tracing actual data flows and aligning DPDP with RBI outsourcing rules is essential.”
The practical implication is that checking whether a vendor signed a Data Processing Agreement does not ensure compliance. Because the Reserve Bank of India’s 2025 Directions set a compliance deadline of 10 April 2026, firms cannot manage privacy terms and banking outsourcing reviews on separate tracks. This suggests that legal and compliance teams should evaluate vendor contracts using a single combined review.
Furthermore, how a tech vendor labels itself in sales talks does not fix a firm’s legal exposure. Under Section 8(1), the fiduciary keeps legal accountability regardless of contract disclaimers. If a vendor takes independent control over customer data, it risks being treated as a fiduciary. When onboarding vendors, firms should trace actual data flows, limit third-party data use to clear business needs, and ensure contract indemnity terms reflect the fiduciary’s heavy financial exposure.
Frequently Asked Questions
Bhanujeet Choudhary
Head of Compliance, KYCKART
Published August 30, 2026 · Updated September 29, 2026
Disclaimer: This article is KYCKART’s informational interpretation of publicly available regulatory sources, including the DPDP Act, the DPDP Rules, 2025, and Reserve Bank of India outsourcing directions. It is not legal, regulatory, tax or compliance advice. Organizations should verify specific statutory requirements against primary publications and consult qualified legal counsel before entering into commercial contracts or classifying third-party vendor relationships.
Next Steps for BFSI
Align Your Vendor Architecture with DPDP & RBI Mandates
Talk to KYCKART’s compliance specialists to audit third-party data flows, review DPAs, and ensure zero commingling across your verification pipeline.
Schedule Consultationarrow_forward