Back to BlogPrivacy readiness checklists

Vendor and processor review checklist

Under the DPDPA, using a vendor to process personal data doesn't transfer your responsibility for it. A data fiduciary generally remains accountable for how a processor handles data on its behalf. This checklist is a starting point for questions worth asking before, and after, a vendor comes on board.

Your progress

0 / 8

Before you sign

The vendor can explain what personal data they'll access and why.You know where that data will be stored and processed.The vendor has a documented approach to security, not just a verbal assurance.

Contract terms to include

The contract limits the vendor to processing data only for the purposes you specify.The contract requires the vendor to notify you of a suspected breach.The contract covers what happens to the data when the relationship ends.

Ongoing oversight

Someone reviews vendor access periodically, not just at onboarding.You'd know if a vendor started using a sub-processor you hadn't reviewed.

Want a scored, prioritised view instead of a flat checklist?

Run the free assessment

From the source

The provisions this guide draws on — official text, in English.

Browse the full DPDP Act and Rules

Curious what this looks like in practice? We publish our own sub-processor list and Data Processing Addendum.

See our sub-processors