Short answer: under India’s Digital Personal Data Protection (DPDP) Rules, 2025, the organisation that decides why and how personal data is processed, the data fiduciary, stays responsible for that data even when a vendor, the data processor, handles it. Rule 6 requires reasonable security safeguards for data processed by a processor too, including appropriate security terms in the processor contract. Most of these duties apply from about May 13, 2027, so the vendor inventory, contract review and evidence work needs to start now.
That date feels distant, but vendor remediation is slow. Contracts renew on their own cycles, processors need time to change logging and retention, and nobody can prove a safeguard that was never recorded. This article sets out the timeline, the five things to demand from every processor, and a practical plan. It is an operational guide for risk and compliance teams, not legal advice; confirm the exact wording against the notified Rules.
Crest.Digital’s third-party risk management platform gives you one vendor register, tiered by data exposure, with continuous monitoring and a full evidence trail.
Explore TPRM SolutionsWhat Applies When: The Phased Timeline
The Rules were notified on November 13, 2025, and Bar & Bench’s summary describes three tranches of commencement.
Immediately (November 13, 2025): the provisions on the Data Protection Board, covering its constitution and operation. After 12 months (about November 13, 2026): Rule 4, on consent manager registration and obligations. After 18 months (about May 13, 2027): the core fiduciary obligations, including notice and consent, data principal rights, reasonable security safeguards, breach intimation, children’s data and cross-border transfer rules.
The sensible planning stance for a bank, insurer, NBFC or large platform is to treat May 2027 as the latest date, not the target. Watch the Gazette and MeitY announcements for any change.
Why Vendors Are the Exposure Point
Under the Act, the fiduciary remains responsible for compliance regardless of what it agrees with a processor, and it may engage a processor only under a valid contract. Rule 6(1) then reaches into the vendor’s environment: the safeguards must cover personal data the fiduciary processes through a processor as well, as published summaries of the Rule describe it.
In practice this means the payroll provider, the cloud host, the CRM, the collections agency, the marketing platform and the offshore support desk are all inside your compliance perimeter. Their failures become your failures, and the penalty exposure stays with you. The Act’s schedule, as summarised by the Press Information Bureau, allows penalties of up to ₹250 crore for failing to maintain reasonable security safeguards. Vendor-caused incidents have already shown how accountability lands on the customer, as in our analysis of the LabCorp AMCA settlement.
Five Things to Demand From Every Data Processor
Rule 6 lists minimum measures. Mapped to vendor oversight, they become five concrete demands. Apply them in proportion to the sensitivity and volume of data each vendor handles.
1. A contract clause that carries the safeguards. Rule 6 calls for appropriate provisions in the fiduciary’s contract with each processor. Review whether existing agreements specify encryption or masking, access limits, logging, backup, breach reporting and sub-processor controls. Generic confidentiality language is unlikely to be enough. See vendor contract risk management for the clause review approach.
2. Access control you can inspect. The Rules require controls over the computer resources used by the fiduciary or its processor. Ask who at the vendor can see your data, how access is granted and removed, and whether privileged use is recorded. Our vendor risk assessment checklist covers the questions.
3. Logs and one-year retention. Rule 6 asks for logs, monitoring and review of access to personal data, and for logs and personal data to be retained for one year unless another law requires otherwise. Commentary on Rule 8(3) gives the example of a cloud provider that must also retain the logs. Confirm that each processor actually keeps them, in a form you can obtain.
4. A breach notification chain that fits the clock. Rule 7, as described in secondary summaries, requires prompt notice to affected individuals and to the Data Protection Board, with fuller details within 72 hours unless the Board allows longer. That clock starts with you, so a processor that tells you after five days has already broken your timeline. Contract for notification within hours, and rehearse it, using the approach in third-party incident response.
5. Continuity and sub-processor visibility. Rule 6 includes measures for continued processing, such as backups, if data is compromised or lost. Ask for recovery evidence and for a list of the processor’s own sub-processors, because your data often sits with a fourth party you never contracted with.
Worked Example: A Payroll Platform (Illustrative)
The following is a hypothetical scenario to show the workflow, not a customer case study. An Indian NBFC uses a cloud payroll platform holding employee identifiers and bank details. The platform is tiered high for data exposure. During review the team finds three gaps: the contract has only a generic confidentiality clause, the vendor keeps access logs for 90 days, and the breach notice commitment is “without undue delay” with no number of hours.
The remediation plan is a contract addendum with explicit safeguard, logging and notification terms; a request that logs be kept for at least a year; and a quarterly evidence request. Each item is recorded in the vendor file with an owner and due date. If the vendor refuses, the file records the risk acceptance by a named executive, or the exit plan in line with vendor exit and offboarding risk. That record is what a regulator or internal auditor will want to see.
A Six-Step Plan to Reach May 2027
Map Personal Data to Vendors
List every vendor that stores, accesses or processes personal data, the categories involved, and where it is held. Include sub-processors where known.
Tier by Data Exposure
Rank processors by volume, sensitivity and data principals affected, so effort goes first to the few vendors that could cause the largest incident. Our guide to vendor classification and tiering explains the method.
Gap-Check Contracts Against Rule 6
Compare each high-tier contract with the safeguards, logging, retention and breach terms above, and list the amendments required at renewal or by addendum.
Collect Evidence, Not Assurances
Request artefacts: log retention settings, access reviews, recovery test results and independent reports, not a signed questionnaire alone.
Monitor Continuously and Report
Track changes in vendor posture, certificates and incidents through the year, and report status to the board. See continuous vendor monitoring for Indian BFSI.
Steps four and six are where most programmes struggle, because chasing evidence from dozens of vendors is manual. Crest.Digital’s Voice AI for GRC can handle evidence follow-up and renewal outreach, while TPRM agents monitor vendor signals and flag changes for a human reviewer. People still decide on risk acceptance; the agents gather and log the evidence.
See how Crest.Digital helps regulated teams in banking and financial services and other industries track processors, contracts and monitoring in one place.
Four Questions to Ask Before May 2027
- Do you know your processors? Can you list every vendor holding personal data and what it holds?
- Do the contracts carry the safeguards? Rule 6 expects it, and generic clauses may not meet it.
- Can vendors meet your clock? Could each top processor alert you quickly enough for a 72-hour notice?
- Can you prove it? For one sampled vendor, can you show the evidence you reviewed and who approved the residual risk?
Share this with your DPO and head of procurement. Both inherit the vendor work.
Frequently Asked Questions
The Rules were notified on November 13, 2025 and commence in phases. The Data Protection Board provisions applied immediately, the consent manager rule (Rule 4) applies after 12 months, around November 13, 2026, and most data fiduciary obligations apply after 18 months, around May 13, 2027. MeitY has floated a shorter window for significant data fiduciaries, but a September 2026 review found no amending notification. Confirm against the Gazette.
Yes, in practice. The Act keeps the fiduciary responsible for compliance, and Rule 6 requires reasonable safeguards for data processed through a processor. A vendor contract can allocate costs and indemnities between the parties, but it does not move the fiduciary’s regulatory responsibility to the vendor. Take legal advice on contract terms for your situation.
At minimum: the security safeguards the processor must maintain (such as encryption or masking and access control), logging and one-year retention of relevant logs, backup and recovery commitments, a time-bound breach notification duty, controls on sub-processors, audit or evidence rights, and exit and data return terms. Your counsel should draft the exact language.
Secondary summaries of Rules 6 and 8 describe a minimum one-year retention of relevant logs and personal data, unless another law requires a different period. The obligation extends to data handled by a processor, so a cloud or SaaS vendor must be able to retain and provide those logs. Check the notified text for the precise scope.
AI agents can compare contracts against a Rule 6 checklist, chase vendors for evidence, watch for incidents and certificate changes, and compile the audit file. They do not decide what risk is acceptable. A named person reviews exceptions and approves residual risk, and every agent action should be logged so the reasoning can be reviewed later.