Back to Module
3 of 3|Documentation & Compliance
video 20 min•Required Documents
Vendor Agreements
The Data Processing Agreement (DPA).
🎯 Learning Objectives
- ▸ Understand the mandatory clauses in a DPA
- ▸ Learn how to negotiate DPAs with vendors
DPA Clauses
A DPA is not a standard vendor contract. It must contain specific privacy clauses:
- • Scope of Processing: Vendor can only process data as instructed.
- • Confidentiality: Vendor staff must keep data confidential.
- • Security: Vendor must implement specific security measures.
- • Sub-processing: Vendor cannot hire another vendor without your permission.
- • Assistance: Vendor must help you respond to user rights requests.
- • Deletion: Vendor must delete data when the contract ends.
📖 Glossary
- DPA
- Data Processing Agreement, a contract between a Data Fiduciary and a Data Processor.
- Sub-processor
- A third-party vendor hired by your vendor to process data.
🔑 Key Takeaways
- A DPA is legally required.
- It must specify the purpose and security measures.
- The DPA must allow you to audit the vendor.
📚 Further Reading
- DPDPA Section 8(2) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...