Template library

Third-party vendor agreement

Vendor terms that first classify the vendor — processor or independent fiduciary, per purpose — and attach the matching duty set automatically, with incident windows, audit rights and data-sized liability. For every vendor whose services touch personal data.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Agreement Date][Customer Organisation Name][Customer Registered Office][Vendor Name][Vendor Registered Office][Service Description][Audit Notice Period][Personnel Screening Standard][Incident Notice Hours][Interim Report Hours][Data Liability Cap][General Liability Cap][Insurance Minimum Amount][For low-risk engagements, the parties may substitute the reduced-risk annex at Schedule B with proportionate caps.][Change Accommodation Period][Jurisdiction City][Customer Signatory Name][Customer Signatory Title][Vendor Signatory Name][Vendor Signatory Title]

The document

The opening clauses — open to everyone

This third-party vendor agreement is made on [Agreement Date] between [Customer Organisation Name], with its registered office at [Customer Registered Office] (the Customer), and [Vendor Name], with its registered office at [Vendor Registered Office] (the Vendor).

1. The services and the data they touch

1.1 The Vendor provides [Service Description] (the Services).

1.2 Annex 1 lists every personal data set the Services touch — items, categories of Data Principals, and purpose. If Annex 1 is empty, clauses 2 to 6 stand down until it is not, and the Vendor must notify the Customer before the Services first touch personal data.

2. Which hat the Vendor wears

2.1 For each Annex 1 purpose, the annex records whether the Vendor processes on the Customer's behalf (a Data Processor) or determines the purpose and means itself (a Data Fiduciary in its own right). A vendor can wear different hats for different purposes.

2.2 Classification has automatic consequences: Part A applies to processor purposes, Part B to independent-fiduciary purposes. Nothing in this agreement makes the parties joint determiners of any purpose.