Template library

Data processing agreement

A fiduciary–processor contract built around the DPDP Act's one-sided liability: rule 6 safeguards as contractual minimums, breach clocks, erasure with certificates, and a load-bearing indemnity. Required whenever a processor handles personal data on your behalf.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Agreement Date][Data Fiduciary Name][Fiduciary Registered Office][Data Processor Name][Processor Registered Office][Master Services Agreement Reference][Breach Notification Hours][Erasure Execution Days][Rights Assistance Days][Audit Notice Period][Liability Cap Amount][Insurance Minimum Amount][Jurisdiction City][Fiduciary Signatory Name][Fiduciary Signatory Title][Processor Signatory Name][Processor Signatory Title]

The document

The opening clauses — open to everyone

This data processing agreement is made on [Agreement Date] between [Data Fiduciary Name], with its registered office at [Fiduciary Registered Office] (the Fiduciary), and [Data Processor Name], with its registered office at [Processor Registered Office] (the Processor).

1. Roles, and why this agreement is strict

1.1 The Fiduciary determines the purposes and means of processing; the Processor processes personal data on the Fiduciary's behalf under the services described in [Master Services Agreement Reference].

1.2 Section 8 (2) of the DPDP Act, 2023 lets a Data Fiduciary engage a processor "only under a valid contract"; this agreement is that contract. The Act places every statutory duty — and every penalty, up to ₹250 crore for failed security safeguards — on the Fiduciary alone, including for the Processor's failures. The obligations and the indemnity below exist because of that allocation.

2. What the Processor may do

2.1 The Processor processes only the personal data described in Schedule 1, only on the Fiduciary's written instructions, and only for the purposes Schedule 1 states.

2.2 The Processor must not use the data for any purpose of its own. If it does, it becomes a Data Fiduciary in its own right for that use, carries the Act's duties and penalties itself in respect of it, and is in material breach of this agreement.