Vendors
DPA clauses under the DPDP Act: what the law requires versus good drafting
The DPDP Act prescribes almost nothing about Data Processing Agreement content: a valid contract, a security safeguards provision under Rule 6(1)(f) and the power to make the processor erase and, on consent withdrawal, cease processing. Every other standard DPA clause is drafting, and this article maps each clause to its real basis, including why the twenty four hour processor notification duty quoted online does not exist.