Data Processor Obligations

The DPDPA takes a notably different approach to Data Processors compared to frameworks like the GDPR. While the GDPR imposes direct statutory obligations on processors (including record-keeping, security, and breach notification), the DPDPA channels all obligations through the Data Fiduciary. A Data Processor processes personal data on behalf of and under the instruction of the Data Fiduciary. The Fiduciary bears primary responsibility for ensuring that its Processors comply with the Act's requirements.

Section 8(2) of the DPDPA states that where a Data Fiduciary engages a Data Processor, the Fiduciary remains responsible for the processing. The Act does not impose independent compliance obligations on Processors - there are no standalone duties for record-keeping, impact assessments, or Board notification. This design choice simplifies the regulatory landscape for processors but creates a "principal-agent" dynamic where the Fiduciary must actively manage and monitor its processing arrangements.

In the absence of direct statutory obligations, the relationship between Fiduciary and Processor is governed by contract. Best practices for data processing agreements include: • Clearly defining the scope, purpose, and duration of processing • Specifying security safeguard requirements • Mandating breach notification to the Fiduciary within defined timelines • Restricting sub-processing without prior authorisation • Requiring deletion or return of data upon termination • Providing for audit rights • Addressing cross-border transfer restrictions The DPDP Rules further clarify the expectations around these contractual arrangements.

While the Act does not directly mandate Processors to implement specific security measures, the Data Fiduciary's obligation to implement "reasonable security safeguards" (Section 8(5)) effectively extends to its Processors. A Fiduciary that engages a Processor with inadequate security is itself in breach. Practically, this means Processors should expect to: • Implement encryption at rest and in transit • Maintain access control mechanisms • Conduct regular security assessments • Maintain incident response capabilities • Demonstrate compliance through certifications or audits

The DPDPA does not explicitly address sub-processing (where a Processor engages another entity to process data). However, the Fiduciary's overall responsibility means that sub-processing arrangements must be: 1. Authorised by the Data Fiduciary 2. Subject to equivalent contractual protections 3. Transparent - the Fiduciary should know the full processing chain Organisations acting as Processors should maintain a register of sub-processors and ensure contractual flow-down of obligations.

The GDPR (Articles 28-29) imposes direct statutory obligations on processors, including: • Record-keeping of processing activities (Article 30(2)) • Appointment of a DPO in certain circumstances (Article 37) • Direct liability and administrative fines (Article 83) • Mandatory data processing agreements (Article 28(3)) The DPDPA's approach of channelling obligations through the Fiduciary is simpler but creates uncertainty for Processors who may prefer clear statutory standards to contractual variability. Organisations that are Processors under both GDPR and DPDPA should consider maintaining the higher GDPR standard across their operations for consistency.