Template · Processor agreement
Data Processing Agreement under Section 8(2)
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Rule 6(1)(f) requires that contract to bind the Processor to reasonable security safeguards. The agreement is the only instrument that carries the Fiduciary’s duties across to the vendor, so it has to say what the vendor may do, how it secures the data, what happens on a breach, and what happens at the end.
From the Gevox Readiness Index: Sixteen of twenty advisor websites run forms through a third party and say nothing about it.
Why it exists
The Processor has no direct duties under the Act. Section 8(1) keeps the Fiduciary responsible for everything the Processor does. The contract is where the Fiduciary passes down the standard it is held to, and it is what an inquiry will ask for first.
What a checklist misses
A checklist asks whether vendor terms were accepted. The Act asks whether those terms bind the vendor to Rule 6 safeguards, to erasure under Section 8(7), to breach notice fast enough for the Fiduciary’s seventy-two hour clock, and to processing only on instructions. Standard SaaS terms rarely cover all four.
What it must cover
- 01Parties and rolesWho is the Data Fiduciary, who is the Data Processor, and for which data.Section 2(i), 2(k)
- 02Scope and instructionsThe processing permitted, the purpose, and that the Processor acts only on documented instructions.Section 8(2)
- 03Security safeguardsEncryption or masking, access control, logging retained one year, backups, and the measures the Processor must maintain.Section 8(5), Rule 6(1)(a) to 6(e), 6(f)
- 04Breach noticeThe Processor tells the Fiduciary without delay, with enough detail for the Fiduciary to intimate the Board within seventy-two hours.Section 8(6), Rule 7
- 05Sub-processorsWhich are used, where they are, and that the same obligations flow down.Section 8(2), Rule 6(1)(f)
- 06Location and transfersWhere data is stored and processed, and any restriction under Section 16 or a sectoral rule.Section 16, Rule 15
- 07Erasure at the endErasure or return of all personal data when the purpose ends or on instruction, and confirmation of it.Section 8(7), Rule 8
- 08Assistance with rights and auditsHelp the Fiduciary answer access, correction and erasure requests, and evidence compliance on request.Sections 11, 12, Rule 14
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Data Processing Agreement. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
3. SCOPE OF PROCESSING
Categories of Personal Data the Processor may access:
Full name, Mobile number, Payment details
The Processor shall process Personal Data ONLY for the following purposes. Processing for any other purpose requires fresh written instruction from the Fiduciary:
Processing payments for orders placed on northline.example
This purpose limitation is the legal boundary of the engagement, not a commercial preference: processing outside the listed purposes has no instruction behind it, leaving the Fiduciary exposed under Section 8(1) and the Processor in breach of this DPA.
Categories of Data Principals affected:
Customers
4. PURPOSE LIMITATION AND INSTRUCTIONS
The Processor shall process Personal Data only on, and strictly within, the documented instructions of the Fiduciary. Section 8(2) of the Act allows a Data Processor to be engaged only under a valid contract, and Section 8(1) keeps the Fiduciary responsible for the processing.
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
Clause headings with their purpose. Gevox generates the agreement for a named vendor from the client’s processor register.
Clause 1, Roles
The Customer is the Data Fiduciary. The Vendor is the Data Processor for the personal data described in Schedule 1.
Clause 2, Instructions
The Vendor processes personal data only to provide the Service and only on the Customer’s documented instructions.
Clause 3, Security
The Vendor maintains the safeguards in Schedule 2, which meet at least Rule 6 of the DPDP Rules 2025, and retains access logs for one year.
Clause 4, Breach
The Vendor notifies the Customer within twenty-four hours of becoming aware of a personal data breach, with the details Rule 7 requires.
Clause 5, End of processing
On termination or instruction, the Vendor erases or returns all personal data within thirty days and confirms in writing.
Questions people ask
- Are a vendor’s standard terms enough?
- Only if they cover instructions, Rule 6 safeguards, breach notice, sub-processors, location and erasure. Most cover some; check each.
- Do we need a DPA with our email provider?
- Yes, if it holds personal data on your behalf, which an email provider does.
- Does the DPA replace consent?
- No. Consent is between you and the Data Principal. The DPA is between you and the vendor.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.