The Data Processors under DPDPA are those who process the personal data on behalf of a Data Fiducairy. Such Data Processors are not directly liable under DPDPA for penalties. However Data Fiduciaries are required to execute appropriate contracts so that their responsibilities are adequately transferred to the data processors.
Hence the Data Processor Contract may be drafted as a reflection of DPDPA. In other words the Data Processor Contract is a distillation of DPDPA into the one or more specific purposes for which the processing contract is drafted.
One way this could be achieved in existing contracts is to modify them with a “Notwithstanding” clause and sign an addendum to include DPDPA related procisions as a development under a change of law.
Such an addendum may contain specific provisions such as
a) Processing shall be only for the authorised purpose which is further clarified in the addendum
b) Drawing attention to the mandatory nature of Section 8(2) which states “A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract.“
c) Drawing attention to the provisions of Section 72A of Information Technology Act 2000
d) Non appointment of sub contractors or AI without specific consent from the data fiduciary
e) Provision for audit by the data fiducairy
f)Cooperation in meeting the requirements of compliance of DPDPA by the Data Fiduciary including meeting the rights of the data principals, data breach notification, cross border data transfer restrictions if any, reasonable security safeguards to be adopted etc.
Ujvala Consultants had in the past proposed a review of the Standard Contractual Clauses under GDPR and an Audit cum Assurance certification for Data Processors under GDPR. Now Naavi has proposed the DGPSI-DP as a framework of compliance for the “Emancipated Data Processors” as a voiluntary measure which can be audited and certified by the Independent Data Auditors trained by FDPPI.
This is an interesting professional opportunity for the advocates and more appropriately those who register as “Progationary IDAs” to undertake a one day certification program entirely on Data Processing contracts. Interested persons my contact FDPPI for more details.
Naavi
