DPDP Vendor Comparison Scorecard

Consent Ledger

Does the vendor maintain a complete, auditable consent record — capturing who consented, to what specific purpose, and when — that the Data Fiduciary can access or export on request?

Data Minimisation by Default

Does the vendor collect only personal data strictly necessary for the stated purpose — and does the default configuration avoid high-sensitivity data types (keystroke logging, always-on screen capture, continuous webcam feed) unless explicitly enabled by the Data Fiduciary?

Purpose Limitation

Is the purpose of each category of personal data collected clearly specified in vendor documentation, and does the vendor prevent secondary use of collected data for purposes beyond the original notice (e.g. vendor-level analytics, model training on client data)?

Audit Log

Does the vendor maintain a complete, tamper-evident log of all personal data processing activities — access events, exports, deletions — and make this accessible to the Data Fiduciary for compliance review or Data Protection Board inquiry?

Significant Data Fiduciary (SDF) Readiness

If your organisation is designated (or likely to be designated) a Significant Data Fiduciary under DPDP §10, has the vendor documented its support for the additional obligations: Data Protection Impact Assessment (DPIA), appointment of a Data Protection Officer, and annual independent audits?

DPO Sign-off Path

Does the vendor provide a documented, accessible engagement path for your Data Protection Officer — including a named point of contact, an escalation process for DPDP queries, and the ability to receive written confirmation of processing activities?

Breach-Notification SLA

Does the vendor contractually commit to notifying the Data Fiduciary of a personal data breach within a defined window (industry standard is 72 hours from detection), with a written breach report covering scope, affected data categories, and remediation steps?

Retention Controls

Does the vendor provide configurable data retention periods — and does it automatically delete or irreversibly anonymise personal data once the retention period ends, without requiring a manual deletion request from the Data Fiduciary each time?

Sub-Processor Transparency

Does the vendor publish a complete, current list of sub-processors (third parties who process personal data on the vendor's behalf), including each sub-processor's country of operation and the category of personal data they access?

Access & Erasure Handling

Does the vendor provide an operational mechanism — not just a contractual promise — for fulfilling Data Principal rights under DPDP §11–14: the right to access summary of personal data processed, the right to correction, the right to erasure, and the right to nominate? Is there an automated or semi-automated workflow, or does fulfilment require a support ticket with no SLA?

Data Residency — India

Is personal data (including employee and contractor activity data) processed and stored within India, or in jurisdictions explicitly approved by the Central Government under DPDP §16? Does the vendor provide written confirmation of data residency and offer India-region hosting as a standard option?

Cross-Border Transfer Basis

If personal data is transferred outside India (including to the vendor's parent company, cloud infrastructure, or support teams in other countries), does the vendor document the lawful transfer basis under DPDP §16 — and does it notify the Data Fiduciary of new cross-border transfers before they begin?