Lesson 7.6: Vendors and processor contracts

Module 7 · Lesson 7.6 of 8 · About 30 minutes · Vendors and processor contracts

Your vendor is your risk. Contract and check. This DPDPA 2023 course page explains vendors and processor contracts in plain language.

vendors and processor contracts - DPDPA 2023 course lesson banner

What you will learn about vendors and processor contracts

Run vendor due diligence
Use a contract checklist
Plan offboarding

Two checks (vendors and processor contracts)

Before onboarding: does the vendor meet your safeguards? After onboarding: do they keep to them?

Vendor lifecycle

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Due diligence questions (vendors and processor contracts)

Question	Why
Where is data stored	Transfers
Who can access	Security
Sub-processors	Chain risk
Breach history	Risk
Certifications	Assurance

Worked example

Before signing with a new CRM provider, the firm asks the five questions and gets a written reply.

Activity (5 minutes) (vendors and processor contracts)

Check your top three vendor contracts for the six clauses in Module 2, lesson 4.

Key takeaway: Keep one standard addendum to attach to every vendor contract.

Check your understanding of vendors and processor contracts

Q1. Vendor contract should require:

Q2. At exit, vendor should:

Q3. Review vendors:

← Data inventory and records Governance, training and records →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for vendors and processor contracts: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.