Data Processing Agreement (DPA)

DATA PROCESSING AGREEMENT

This Data Processing Agreement is made on [Date] between [Party A Name], having its office at [Address] ("Data Fiduciary / Controller"), and [Party B Name], having its office at [Address] ("Data Processor").

1. Subject Matter. This Agreement governs the processing of personal data by the Processor on behalf of the Controller in connection with [Services] with effect from the Effective Date.
2. Purpose Limitation. The Processor shall process personal data only on the documented instructions of the Controller and solely for the stated purpose.
3. Compliance. Both parties shall comply with the Digital Personal Data Protection Act, 2023 and all applicable data protection laws of India.
4. Security Measures. The Processor shall implement reasonable technical and organisational safeguards including encryption, access control and audit logs to protect the data.
5. Sub-Processing. The Processor shall not engage any sub-processor without the prior written consent of the Controller and shall flow down equivalent obligations.
6. Data Subject Rights. The Processor shall assist the Controller in responding to requests from data principals for access, correction and erasure.
7. Breach Notification. The Processor shall notify the Controller of any personal data breach without undue delay and in any case within [Number] hours of becoming aware.
8. Return & Deletion. On termination, the Processor shall, at the Controller's option, return or securely delete all personal data and certify such deletion.
9. Audit. The Controller may audit the Processor's compliance on reasonable prior notice.
10. Governing Law & Jurisdiction. This Agreement shall be governed by Indian law and subject to the exclusive jurisdiction of the courts at [City].

IN WITNESS WHEREOF, the parties have signed this Data Processing Agreement on the date first written above.