Third-Party and Vendor Risk Management Under the DPDP Act

Hero Summary

Under India's Digital Personal Data Protection (DPDP) Act, 2023, a data fiduciary that engages a data processor to handle personal data on its behalf remains responsible for that data — the processor must be engaged under a valid contract, and the fiduciary cannot hand off accountability. Third parties are also a leading cause of breaches: in IBM's 2025 Cost of a Data Breach research for India, third-party vendor and supply-chain compromise was the initial attack vector in 17% of breaches. Managing vendor risk is therefore both a legal and a security priority.

Executive Summary

Most organizations rely on dozens or hundreds of vendors that touch personal data: cloud hosts, SaaS tools, payment processors, marketing platforms, call centers, and consultants. Each is a potential point of failure and a potential source of regulatory exposure. This guide explains the DPDP accountability model for processors, what to include in vendor contracts, how to assess vendors before and after onboarding, how to monitor them, and how to prepare for a vendor-caused breach. It also connects vendor management to the broader data map and breach response program.

The accountability model {#accountability}

The DPDP Act distinguishes a data fiduciary — the organization that decides why and how personal data is processed — from a data processor, which processes data on the fiduciary's behalf. The Act allows a fiduciary to engage a processor only under a valid contract, and it holds the fiduciary responsible for compliance with the Act for personal data in its control, including processing undertaken on its behalf by a processor, irrespective of any agreement to the contrary. In plain terms: if a vendor mishandles your customers' data, you are accountable to the regulator and to the individuals.

Why vendors are a risk {#risk}

According to IBM's 2025 Cost of a Data Breach research for India, the top initial attack vectors were phishing (18%), third-party vendor and supply-chain compromise (17%), and vulnerability exploitation (13%), and the average total cost of a breach in India was INR 220 million, about 13% higher than in 2024. Vendors add risk because they hold your data under their own security controls, may use their own sub-processors, may be breached through their own weaknesses, and may have privileged connections into your systems.

Step 1: Know your vendors {#inventory}

Build and maintain a register of every vendor that handles personal data or connects to your systems: what they do, what data they hold, where it is stored, who in your organization owns the relationship, and the contract status. Your data map should identify vendor relationships; see Data Mapping and Records of Processing Under DPDP.

Step 2: Tier vendors by risk {#tiering}

Not every vendor needs the same scrutiny. Tier them by:

• the sensitivity and volume of personal data they handle (for example, children's data, financial or health data, or large customer databases);
• the criticality of the service to your operations;
• the level of access they have to your systems; and
• whether they use sub-processors or process data outside India.

High-risk vendors get deeper assessment, tighter contracts, and more frequent review.

Step 3: Due diligence before onboarding {#due-diligence}

• Security assessment — a questionnaire and evidence review covering access control, encryption, logging, vulnerability management, incident response, and business continuity.
• Independent assurance — reports or certifications such as ISO/IEC 27001 or SOC 2 where available, understanding exactly what scope they cover.
• Privacy review — how the vendor processes, stores, retains, and deletes personal data, and where.
• Sub-processor and location review — who else touches the data and in which country.
• Incident history and financial resilience, for critical vendors.

Step 4: Contract clauses {#contracts}

A data processing agreement should at minimum cover:

• Scope and purpose — processing only on your documented instructions and only for the agreed purpose.
• Security safeguards — minimum controls, aligned to your own standard.
• Breach notification — prompt notice to you, with a defined timeframe and the information you will need to notify the Data Protection Board and affected individuals.
• Sub-processors — prior approval and flow-down of the same obligations.
• Data location and cross-border transfers — where data may be processed. See Cross-Border Data Transfers Under DPDP.
• Individual rights support — assistance with access, correction, and erasure requests.
• Deletion or return of personal data at the end of the contract, with confirmation.
• Audit and assessment rights, and cooperation with regulators.
• Liability and indemnity aligned to the risk.

Step 5: Ongoing monitoring {#monitoring}

• Reassess on a schedule based on tier — annually for high-risk vendors.
• Track changes — new sub-processors, new locations, ownership changes, and security incidents.
• Monitor externally visible security where practical, such as the vendor's exposed domains and certificates.
• Review access regularly and remove privileges that are no longer needed.
• Test response — include critical vendors in incident exercises.

Step 6: Offboarding {#offboarding}

When a relationship ends, revoke access, retrieve or delete personal data, obtain written confirmation of deletion, and update your inventory. See DPDP Data Retention and Erasure.

Vendor breach readiness {#breach}

Assume a vendor will eventually be breached. Know who to call, what the contract requires them to tell you and by when, and how you will assess which of your data was involved. Remember that DPDP breach duties fall on you, the fiduciary, even when the incident occurred at the vendor. See Data Breach Response Under DPDP.

How Threat ResQ fits {#threat-resq-fit}

PrivacyIQ, Threat ResQ's privacy management platform, includes vendor governance alongside a data inventory, privacy requests, and an incident register. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status. getTRAC automates evidence collection and control mapping across frameworks. Threat ResQ's IT Security Audit and Compliance Consulting services support vendor and control reviews.

FAQ {#faq}

Who is responsible if my vendor causes a data breach? Under the DPDP Act, the data fiduciary remains responsible for personal data processed on its behalf by a processor, so you are accountable even when the incident happens at the vendor.

What must a contract with a data processor include? At a minimum: processing only on your instructions, security safeguards, prompt breach notification, sub-processor controls, data location limits, support for individual rights, deletion or return of data, and audit rights.

How common are third-party breaches? In IBM's 2025 research for India, third-party vendor and supply-chain compromise was the initial attack vector in 17% of breaches, second only to phishing at 18%.

How often should vendors be reassessed? By risk tier — high-risk vendors at least annually and on any significant change, lower-risk vendors less often.

What should happen when a vendor relationship ends? Revoke access, have the vendor return or delete personal data and confirm in writing, and update your data inventory and vendor register.