DPDP and vendor contracts: what big clients now ask of small suppliers

Even if no regulator ever contacts you, your clients may. If you are a freelance developer, agency, delivery partner or recruiter working for companies, the DPDP Act will shape your contracts. The main duties start on 13 May 2027.

Why contracts are changing

The Act puts the legal responsibility on the organisation that decides how personal data is used (the Data Fiduciary). Under Section 8(2), that organisation may use a supplier to process data (a Data Processor) only under a valid contract, and it stays responsible for what the supplier does. So large clients, facing penalties of up to hundreds of crores, push the duty down to suppliers in writing, usually as a Data Processing Agreement.

Clauses to expect

You can expect clients to ask for some or all of these:

• Prompt breach reporting. Clients may ask for notice within a short window such as 24 or 48 hours, because they have their own deadlines to the Board.
• Security standards. Access controls, encryption, and limits on who can see their files.
• Deletion or return of data when the project ends, sometimes with a written confirmation.
• Indemnities and liability. Some clients try to make the supplier pay for regulatory fines caused by the supplier's team.
• Audit rights and approval of sub-suppliers.

Before you sign

• Read the privacy clauses, not just the price.
• Promise only the security you can really deliver.
• Negotiate a sensible limit on liability rather than accepting unlimited liability for things outside your control.
• For a large contract, get legal advice.

Simple rule: your clients will pass their privacy duties to you by contract, so read the fine print before you sign.

Check your readiness, and see how we handle our own providers.

General information, not legal advice. Check the Act and Rules before relying on it.