Is a Data Processing Agreement mandatory under the DPDP Act?

Yes. Section 8(8) explicitly mandates that a Data Fiduciary may engage a Data Processor to process personal data on its behalf only under a valid contract executed in accordance with Rule 6(f).

What happens if a vendor experiences a data breach?

Under Rule 6(f) DPAs, processors must notify the Data Fiduciary immediately (typically within 24 hours) so the Fiduciary can report the incident to the Data Protection Board within the statutory 72-hour window.

Where can I generate a Rule 6(f) compliant B2B DPA for free?

You can generate signature-ready B2B Data Processing Agreements for free using the Ronin Works Vendor DPA Generator at roninworks.in/tools/dpa-generator.

DPDP Act Section 8(8) · B2B Vendor Compliance

DPDP Rule 6(f) Data Processing Agreements: What B2B Vendors Must Sign

Published 30 July 2026 · 6 min read · By Ronin Works Team

Short Answer

Under Section 8(8) of the DPDP Act 2023, a Data Fiduciary may engage a Data Processor (SaaS vendors, IT agencies, cloud providers) only under a valid written contract executed in accordance with Rule 6(f). DPAs must include mandatory technical security safeguards, 24-hour breach notification SLAs, sub-processor restrictions, and cascading data erasure clauses upon contract end. Generate signature-ready DPAs for free using our B2B Vendor DPA Generator.

If your business uses third-party SaaS vendors, cloud hosting (AWS/GCP), external CRM software, or outsourced IT agencies, you are legally responsible for how those vendors handle personal data under the DPDP Act 2023.

1. The Mandatory Clauses Required Under Rule 6(f)

A standard Master Services Agreement (MSA) is not sufficient for DPDP compliance. A Rule 6(f) compliant Data Processing Agreement must explicitly contain:

Documented Instructions: Processor must process personal data solely on documented instructions from the Data Fiduciary.
Technical Security Safeguards: Mandatory encryption at rest and in transit, access controls, and logging under Section 8(5).
24-Hour Breach Notification SLA: Mandates the processor to notify the Fiduciary immediately upon discovering a data breach.
Cascading Erasure Obligations: Requires the processor to permanently erase customer data and instruct sub-processors to erase data upon request.
Annual Audit Rights: Grants the Fiduciary rights to audit processor compliance once per year.

Vendor Management & Consumer Erasure: Ronin Works ↔ Saaph.in

When an individual uses Saaph.in to exercise Section 12 data erasure rights, your business must delete their data not only from your primary database but also across all third-party processors.

Having valid Rule 6(f) DPAs in place gives your business the contractual right to enforce cascading erasure instructions onto your vendors. Generate your vendor contracts in 2 minutes using our Free DPA Generator.

Generate Vendor DPA → Open 62-Item Checklist →

2. Generate Signature-Ready B2B DPAs

Avoid paying expensive legal fees for standard vendor agreements. Use our free Vendor DPA Generator to output signature-ready contracts in under 2 minutes.

Legal Disclaimer: This guide provides general administrative information regarding DPDP Section 8(8) vendor agreements. It does not substitute for professional legal review.

B2B Compliance & Vendor Risk

Need Enterprise Data Cleansing or Vendor Risk Audits?

Ronin Works audits third-party vendor risks, cleanses enterprise CRM data, and establishes DPDP vendor compliance governance.