Data Processing Agreement (DPA) Drafting

About this service

Under Section 8 of the DPDP Act, a Data Fiduciary may give personal data to a Data Processor only under a valid contract, and stays responsible for what the processor does with it. An advocate drafts or reviews a Data Processing Agreement covering purpose, security safeguards, confidentiality, breach intimation timelines, sub-processors, cross-border transfer, audit rights and deletion of data when the contract ends. Covers one agreement with one vendor or client.

What you get

• Data Processing Agreement drafted or reviewed for one counterparty
• Security, confidentiality and breach-intimation clauses
• Sub-processor, cross-border transfer and audit clauses
• Return or deletion of data on termination
• Two rounds of revisions

How it works

1. 1

   Share the deal

   Send the main contract and what data changes hands.

2. 2

   Drafting

   The advocate drafts or marks up the DPA.

3. 3

   Revisions

   Two rounds of changes, including the other side’s comments.

4. 4

   Final copy

   A signature-ready agreement.

Documents you will need

• Main service agreement with the vendor or client (if any)
• Description of the data shared and the services provided
• Both parties’ names and registered addresses

Scans or clear photographs are fine. The lawyer handling your matter will tell you if anything else is needed once they have seen your papers.