This is placeholder content. Check every reference against the Digital Personal Data Protection Act and the rules in force at the date of publication.
The Digital Personal Data Protection Act assigns obligations by role. The contract that sits under it assigns work between the parties. When the two are drafted independently — the statute recited in one clause, the work described in another — the result is an agreement where everyone knows what the law says and nobody has agreed who does what at 2am on the day of a breach.
Role is a conclusion, not a choice
The parties cannot allocate the roles of data fiduciary and data processor between themselves by agreement. Those follow from who determines the purpose and means of processing. A clause declaring the customer to be the fiduciary is useful evidence of intention and nothing more; where a provider processes for its own product purposes, it may be a fiduciary in its own right regardless of what the contract says.
The clauses that actually do work
Notice and consent. Which party presents notice to the data principal, in what form, and who owns the record of it.
Rights requests. A data principal exercises a right against the fiduciary. If the data sits in the provider's systems, the fiduciary cannot comply without help. That help needs a defined mechanism and a timescale that is shorter than the statutory one.
Breach. The obligation to notify sits with the fiduciary, who will usually learn of the breach from the provider. The notification period in the contract should therefore be measured in hours.
Sub-processing. Onward transfer, notification of new sub-processors, and whether objection is possible.
Deletion and exit. What is returned, what is deleted, what is retained under other legal obligations, and evidence of each.
A practical test
Read the data clauses and ask: if a data principal made a request tomorrow, would the parties know who does what, in what order, by when. Most agreements that recite the statute perfectly fail that test.
Nothing in this note is legal advice or a substitute for it. Please seek advice on your specific circumstances.
This note is published for general information at the specific request of the reader. It is not legal advice, does not constitute solicitation or advertisement under Rule 36 of the Bar Council of India Rules, and no advocate–client relationship arises from reading it. Please seek advice on your own circumstances.