What Is This Module For?
The Vendor DPA Tracker helps you manage Data Processing Agreements (DPAs) with all vendors (Data Processors) who process personal data on your behalf — a mandatory obligation under the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 8(2) — A Data Fiduciary may engage a Data Processor only through a valid contract that binds the processor to the Data Fiduciary's instructions and the DPDP Act's obligations.
Step-by-Step Guide
- Go to Vendor Risk in the sidebar.
- Add each vendor that processes personal data on your behalf — enter vendor name, service description, data categories shared, and countries of operation.
- Upload the signed DPA for each vendor.
- Set contract expiry dates — dcomply sends alerts 30 days before a DPA expires.
- Mark critical processors — vendors processing sensitive data or large volumes are flagged as critical for enhanced monitoring.
Common Mistakes to Avoid
- Not having DPAs with all vendors — Every vendor that touches personal data needs a DPA — including HR software, CRM, cloud storage, and email marketing tools.
- Using generic vendor contracts — A standard vendor contract is not a DPA. The DPA must specifically address the DPDP Act obligations.
Frequently Asked Questions
Q: Does our cloud provider need a DPA?
A: Yes. AWS, Azure, and GCP all offer DPA addendums. You must execute these and keep copies.