Corporate and Compliance
DPDP Act: Contracts and Privacy Notices That Need an Update
By ATTPL Legal Editorial Team · · 2 min read
India's data protection rules are phased in through May 2027. Review your vendor contracts, consent text and employee data clauses now.
The timeline
Commentators describe the DPDP Rules, notified on 13 November 2025, as phased over roughly 18 months, with a consent-manager framework around 13 November 2026 and wider obligations from about 13 May 2027. Confirm the exact dates with the official notification.
Documents most businesses must revisit
- Privacy notices and consent requests on websites, apps and forms.
- Vendor, cloud and software agreements where personal data is processed on your behalf.
- Employment contracts and HR policies covering employee data.
- Customer terms of service and marketing consent language.
- Breach notification procedures and internal escalation policies.
What good clauses look like
- Clear purpose and limited use of personal data.
- Security safeguards and audit rights.
- Sub-processor approval and cross-border transfer terms.
- Deletion or return of data at the end of the contract.
- Cooperation in handling people's rights requests and incidents.
Roles in the data chain
The Act distinguishes between the entity that decides why and how personal data is processed and the entity that processes it on its behalf. Contracts should state each party's role, the allowed purposes, security obligations, sub-processor rules and what happens to data at the end of the engagement. Agreements copied from foreign templates may not match Indian terminology or the specific obligations in the Act and Rules.
Make a list of all vendors who touch personal data before you start redrafting. Prioritise those with the largest data volumes or highest sensitivity.
Writing a notice people can understand
Privacy notices should be in clear, simple language, describe the personal data collected, the purposes, how to exercise rights and how to complain. If your customers speak Hindi or other Indian languages, offer notices in those languages too. Avoid long legal text hidden behind a small link; show the key points where consent is requested.
Employee and HR data
Employment relationships involve large volumes of personal data, from identity documents to bank and health information. Review offer letters, employee handbooks and HR system settings. Limit access to need-to-know staff, define retention periods for resumes and records of former employees and train managers on confidentiality.
How ATTPL Legal helps
Our corporate and digital legal services review contracts, draft privacy notices and prepare compliance policies for companies in Rajasthan and across India.
Frequently asked questions
Do I need a data protection officer?
Only certain significant data fiduciaries are required to appoint one, as notified. Check applicability with counsel.
Is consent always required?
The Act allows processing on consent and on certain legitimate uses; your lawyer can map each activity.
Sources and further reading
This article is general information, not legal advice, and does not create a lawyer-client relationship. Laws and procedures change; consult a qualified advocate about your specific matter.
