A due-diligence review of your vendor and data-processor contracts against what the Act actually requires them to contain — not a general legal read-through, but a specific check for the clauses DPDPA obligations depend on. Most organisations discover the gap isn't that contracts are missing, it's that the ones in place were never written with a processor relationship in mind.
Most vendor reviews start from a contract list. This one starts by confirming that list is actually complete.
A defined, recurring exercise to identify who your Data Processors are — checked at onboarding, periodic review, and offboarding — not a one-time list that goes stale.
Whether contracts actually bind vendors to process data only on your instructions, a core DPDPA processor requirement.
Whether the agreement gives you visibility into, and control over, vendors further down the chain.
Whether contracts specify what happens to your data once the relationship ends.
Whether the vendor is contractually required to notify you fast enough for you to meet your own Section 8(6) timelines.
Whether you retain the right to actually verify a vendor's practices, not just take their word for it.
The identification cadence is the deliverable that outlasts this engagement — new processors won't slip through unnoticed.
Contract execution and negotiation support sit with Vendor Agreement Annexures, a related but separate service.
Establish the onboarding/review/offboarding cadence and confirm the current vendor list.
Used to confirm the complete, current set of vendors actually handling personal data — not the list assumed from memory.
Gather the current agreements for everyone identified in stage one.
Every agreement tied to a confirmed processor, collected before any clause review begins.
Check each agreement against what the Act requires of a processor relationship.
Processor obligations, sub-processor visibility, breach flow-down, and data return/deletion terms, checked one by one.
Rank vendors by exposure — data sensitivity, contract gaps, and processing volume.
So remediation attention goes to the highest-risk relationships first, not alphabetically.
Deliver findings with clause-level fixes and a sequence for renegotiation.
Actual negotiation and getting new clauses signed is handled separately, by Vendor Agreement Annexures.
That's usually where the real gap is — 30 minutes to talk through scope, no obligation.
Book a Consultation