Data Processing Agreement (DPA)

Yes. The template assumes the customer is a data fiduciary and the service provider is a data processor and includes a mandatory written contract, security safeguard, breach notification, retention, and cooperation obligations in line with sections 8 and 16 of the DPDP Act and associated rules.

Yes. The template is drafted to sit as an addendum or incorporated schedule to a master services agreement, with a clear order-of-precedence clause ensuring data protection terms prevail in case of conflict.

The DPA includes conditional clauses that activate when you indicate cross-border transfers. These clauses describe allowed destinations, require contractual and technical safeguards, and reference DPDP transfer restrictions, while allowing you to add any customer-specific or sectoral transfer controls.

You can configure the data nature field to anonymised-only or mixed data. The template then adjusts clauses that would otherwise apply strictly to personal data, ensuring obligations are proportionate while still addressing confidentiality, security and risk allocation for anonymised datasets.

The template allows you to tag the customer as a Significant Data Fiduciary and reinforce cooperation, record keeping, audit support and DPO communication expectations so that the processor relationship supports the enhanced obligations that apply to such entities under the DPDP Act.