How to Manage Vendors and Cross-Border Transfers

You stay responsible for personal data even when a vendor handles it (Section 8(1)). You may engage a processor only under a valid contract (Section 8(2)). Transfers outside India are allowed unless restricted (Section 16, Rule 15). This DPDPA 2023 course page explains how to manage vendors and in plain language.

Step by step (how to manage vendors and)

1. Build a vendor register. Name, service, data shared, location, contract date, contact.
2. Check each vendor. Use the questions below.
3. Sign the contract clauses. Add a short data-protection addendum if the main contract lacks them.
4. Map transfers. Mark which vendors store or access data outside India.
5. Watch for Government orders. Rule 15 allows conditions on transfers, including access by foreign States, and Section 16 allows restricted countries.
6. Review yearly and when a vendor changes.

Ten vendor questions

Contract clause checklist (Rule 6(1)(f), Section 8(2)) (how to manage vendors and)

• Process only on our written instructions and for the stated purpose
• Reasonable security safeguards equal to Rule 6
• Breach notice to us promptly with details needed for Rule 7
• Sub-processors only with our approval
• Help with rights requests
• Delete or return data on termination and confirm in writing
• Keep logs for at least 1 year
• Cooperate in audits and with Board or Government information demands

Vendor register template

Related guides (how to manage vendors and)

• Security Safeguards
• Data Inventory

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.