Back to Module
11 of 14|Obligations of Data Fiduciary
reading 15 min•Contractual Obligations
Vendor Due Diligence
Checking if your vendors are actually secure.
🎯 Learning Objectives
- ▸ Understand why due diligence is essential
- ▸ Learn the steps of vendor assessment
The Assessment
Before signing a contract, assess the vendor's security posture. Ask for their security policies, audit reports, and incident history. If a vendor refuses to provide this, do not give them your customer data.
The Data Fiduciary is liable for the actions of the Data Processor. If your vendor leaks data, the Data Protection Board will hold YOU responsible.
📖 Glossary
- Due Diligence
- Investigation or exercise of care that a reasonable business or person is expected to take before entering into an agreement or contract with another party.
🔑 Key Takeaways
- Conduct risk assessments of vendors.
- Review their security certifications (ISO 27001, SOC 2).
- Conduct regular audits.
📚 Further Reading
- DPDPA Section 8(2) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...