Question · Processors
Data Processor agreements under Section 8(2)
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Yes. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Rule 6(1)(f) requires that contract to bind the Processor to reasonable security safeguards. Every SaaS tool, host, agency or vendor that processes personal data on your behalf is a Data Processor. Section 8(1) keeps you responsible for what they do.
From the Gevox Readiness Index: Sixteen of twenty advisor websites run forms through a third party and say nothing about it.
Who counts
Cloud hosting, email and SMS providers, form builders, analytics, CRM, payroll, support tooling, payment gateways for the data they process on your instruction, logistics partners, agencies running your campaigns. If they process personal data on your behalf, they are a Processor. If they decide their own purpose for it, they are a Fiduciary in their own right and need their own ground.
What the contract must do
Bind the Processor to process only on your instructions, to maintain Rule 6 safeguards, to tell you of a breach fast enough for your seventy-two hour clock under Rule 7, to flow the same terms to sub-processors, to say where data is held, and to erase when the purpose ends under Section 8(7). Most vendor terms cover some of these.
And the notice must say
Rule 3 requires the processing to be described in a way the Data Principal can understand, which includes who else receives the data. Sixteen of twenty advisor websites ran forms through a third party and said nothing about it.
Questions people ask
- Are vendor terms of service a valid contract?
- They are a contract. Whether they meet Section 8(2) and Rule 6(1)(f) depends on whether they cover instructions, safeguards, breach notice, sub-processors, location and erasure.
- Does the Processor have its own liability under the Act?
- The Act places duties on the Fiduciary. The Processor answers to the Fiduciary under the contract.
- Do we need a contract with a foreign vendor?
- Yes, and Section 16 governs the transfer: permitted unless the country is notified as restricted, subject to any sectoral rule.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.