NASSCOM-Aligned DPDP Vendor Assessment Checklist for India IT Services Exporters (2026)

Why workforce monitoring is a Tier-1 DPDP-and-GDPR vendor for India IT services

An India IT services exporter sits in a structural double-bind on the workforce-monitoring layer. The tool runs on the engineer's laptop, so the exporter is the Data Fiduciary under DPDP for the employee personal data the tool captures — activity windows, application metadata, screenshots if enabled, login events, browser context. At the same time, that laptop is processing the customer's data under the master services agreement, which means anything the monitoring tool captures from the customer-side workload sits inside the exporter's Article 28 processor obligation back to the EU or US controller. A weak vendor on the monitoring layer therefore breaches India-side DPDP and the customer-side GDPR or US state-privacy expectation at the same time.

That is why NASSCOM-member procurement teams have moved workforce-monitoring tools out of the "low-risk HR" bucket and into the Tier-1 vendor assessment lane that already includes the data centre, the laptop fleet vendor, and the IAM platform. The same evidence pack the exporter has to produce for its own DPDP self-assessment must answer the customer's security questionnaire with no daylight between the two. The 12-criteria sheet below is engineered around that double-lens.

The 12 criteria, scored Pass / Patchable / Unknown

Score each candidate the same way: Pass if the criterion is met out of the box with verifiable evidence; Patchable if achievable through deployer-side configuration or a written vendor commitment with a delivery deadline; Unknown if the vendor's public documentation does not let you verify. An Unknown is a procurement question, not a failure — until the answer comes back.

Two notes on this table. First, the EU customer parallel column is what makes this a NASSCOM-shaped checklist rather than a plain DPDP one — every criterion answers the customer questionnaire too. Second, the order is the order a customer's vendor risk team typically reads down a security questionnaire, so the evidence pack you build can be served back in the same order with minimal restructuring.

1. Per-feature lawful basis (DPDP Section 4)

The vendor must surface a consent record for each capture surface — not one product-level toggle. That means a separate Section 4 record for activity-window capture, for application metadata, for screenshots if enabled, for clipboard or browser context if enabled, and for any AI-derived signal that processes personal data downstream. The reason: when the EU customer's auditor asks "what is the lawful basis under which my customer data was captured by your monitoring tool on a developer's laptop," the answer must reference the specific capture surface, not a product toggle.

2. India data residency + region pinning

The vendor must offer an India region for primary storage and document the cross-border transfer posture against the expected Section 16 Rules. The EU customer parallel is whether the same data, when transferred to a customer-instance in the EU, has a defensible SCC or IDTA equivalence position. Mark India residency as Pass only if the vendor publishes the region; Patchable if region pinning is offered on an enterprise tier you have to pay up for; Unknown if the global tenant does not publicly clarify.

3. Surveillance off by default

This is the single strongest architectural signal. A tool that ships with screenshots, keystroke logging, and webcam capture off by default starts every deployment from a defensible position under DPDP minimisation and GDPR Article 5(1)(c). A tool that ships with capture on requires deployer-side hardening before it is auditable; that pushes the criterion to Patchable if the global capture-off switch is verifiable, Unknown if it is not.

4. Data principal rights workflow (Sections 11–14)

The vendor must support the access, correction, erasure, and grievance pathway as a product feature, not as a manual support ticket. The customer-side parallel is GDPR Articles 15–22, including the right to object and the right to portability where applicable. Score on three things: can a data principal initiate a request without going through the employer's HR queue; can the request be resolved within the statutory window; is there evidence the request is logged for audit.

5. Breach SLA meeting the tighter of DPDP and GDPR

The vendor must commit in the contract to a breach-notification SLA that meets the tighter of the two regimes you operate under. Under GDPR Article 33 the controller must notify the supervisory authority within 72 hours of becoming aware; for the India IT services exporter to meet that, the vendor's notification-to-deployer SLA must be measured in hours, not days. DPDP's own Section 8(6) Board-notification timing will be tightened in the Rules.

6. Sub-processor disclosure

The vendor must publish or contractually commit to the list of sub-processors, the geography they sit in, the data they touch, and the change-notification mechanism. GDPR Article 28(2) sub-processor consent expectations are the parallel; without sub-processor disclosure, the EU customer cannot give the prior specific or general authorisation the article requires.

7. Retention policy

Both DPDP Section 8(7) and GDPR Article 5(1)(e) require storage limitation. Score the vendor on whether retention can be configured per capture surface and per data-class, whether the retention clock is logged and auditable, and whether deletion at end-of-retention is verifiable. A vendor that retains screenshots for "up to seven years" with no per-class lever is a fail on both regimes.

8. Tamper-evident audit logs

The audit log layer is the evidence the exporter relies on if a Data Protection Board inquiry lands or an EU customer audit triggers. The criterion: are the logs cryptographically tamper-evident or, at minimum, immutable in the deployer's tenant; can the deployer export them; do they cover both administrative changes (who switched capture on) and data-access events (who queried whose data).

9. DPIA evidence pack (Section 8 + expected SDF Rules)

Where the processing is high-risk — and workforce monitoring with any optional default-on capture surface usually is — the exporter must run a Data Protection Impact Assessment. The vendor's job is to provide the input pack: data-flow diagrams, the categories of personal data captured per feature, the lawful basis per feature, the cross-border flows, the security controls, and the residual risk register. A vendor that does not publish this is forcing the exporter to build it from scratch.

10. Cross-border transfer posture

Section 16 of the DPDP Act sets up a notified-restricted-country pattern for cross-border transfers, the final shape of which is still in staged Rules. The vendor must publish or contract to a transfer posture that survives both the Section 16 final form and the EU customer's GDPR SCC or IDTA expectation. For EU customers specifically, the transfer chain from India through the vendor's cloud to any sub-processor region must reconcile.

11. Named, reachable Data Protection Officer

Section 10 of the DPDP Act anticipates DPO designation for Significant Data Fiduciaries, and GDPR Article 37–39 sets out the parallel requirements. A vendor with a named DPO whose contact is published and reachable simplifies both regimes; one without forces the exporter to route every rights request, breach notification, and audit ask through generic support.

12. Termination data return + delete proof

At contract end, the vendor must either return all customer-side and employee-side data or destroy it with proof. GDPR Article 28(3)(g) is the explicit hook on the customer side; DPDP Section 8(7) and the general processor-termination duty are the India-side parallel. Score on whether the export format is usable, whether the deletion certificate is signed, and whether sub-processor copies are covered.

Mapping the 12-criteria sheet into the customer security questionnaire

The reason for designing the sheet this shape is that EU customer security questionnaires — whether they are based on CAIQ, SIG, or a homegrown template — ask broadly the same 12 questions in different language. The mapping below is a sample, not a contract:

• Lawful basis & minimisation questions in the questionnaire → Criteria 1 and 3.
• Data residency & transfer questions → Criteria 2 and 10.
• Subject rights questions → Criterion 4.
• Breach & incident response questions → Criterion 5.
• Sub-processor & supply chain questions → Criterion 6.
• Retention & deletion questions → Criteria 7 and 12.
• Audit & assurance questions → Criteria 8 and 9.
• Governance & DPO questions → Criterion 11.

The point of the sheet is that the IT services exporter fills it once per vendor and then re-uses the evidence to populate the customer questionnaire every time it comes around, instead of starting from a blank questionnaire on each customer ask. Over a year of customer renewals and net-new wins, that compresses days of work per quarter.

Where India-first and global vendors typically score differently

The pattern in our scoring across India-first and global workforce-monitoring vendors is consistent. India-first vendors (such as DPDP-ready productivity intelligence platforms) tend to score strongly on Criteria 1, 2, 3, 4, and 9 because they were architected against the statute. Global vendors tend to score strongly on Criteria 5, 6, 8, and 11 because they have mature DPA architectures, SOC 2 audits, and named DPOs built for EU customers. The criteria that most often come back Unknown on global vendors are 2 (India region pinning) and 10 (the India-side leg of the transfer chain).

The right pick for any exporter depends on the customer mix. Where the customer mix is heavily EU and the patch budget is real, a global vendor with documented region pinning works. Where the customer mix is mixed or where the patch budget is thin, an India-first vendor with the evidence pack pre-built shortens the cycle. For the deeper neutral shortlist see the DPDP-ready monitoring shortlist and the CISO maturity-tier shortlist.

What to do at the next renewal cliff

1. Run the 12-criteria sheet on the incumbent first. Until you have a Pass / Patchable / Unknown score on your current vendor, you do not know whether staying is cheaper than switching.
2. Convert every Unknown into a written question with a delivery deadline. Give the vendor 30 days to come back with India region commitments, default-off levers, breach SLA in hours, and sub-processor disclosure.
3. Pilot one shortlisted alternative in parallel on a single business unit so the switch cost is bounded if the incumbent does not deliver.
4. Document the assessment outcome as Section 8 vendor due-diligence evidence and feed the same pack into the customer-side Article 28 file. The audit trail itself is worth the exercise.
5. Close with counsel: the staged DPDP Rules timeline, your Significant Data Fiduciary exposure, and the EU customer's exact transfer posture are not generic answers.

Related reading

For the section-by-section DPDP buyer's guide see the DPDP Act 2023 buyer's guide. For the 14 CISO evaluation questions see 14 DPDP questions India CISOs must score. For RFP-grade contract language see the DPDP vendor RFP redline template. For the BPO vertical context see BPO workforce monitoring India.

This article describes the vendor assessment posture India IT services exporters have converged on for workforce-monitoring vendors under the Digital Personal Data Protection Act 2023, the expected DPDP Rules, and parallel EU customer expectations under the GDPR. NASSCOM and DSCI publish their own guidance and member resources; verify against the current versions. DPDP Rules and Data Protection Board notifications are still in staged finalisation — rule text, transition periods, Significant Data Fiduciary designation criteria, and penalty schedules including the INR 250-crore band are subject to revision. No vendor is certified DPDP-compliant; scores reflect DPDP-readiness on public documentation and product configuration at time of writing. Verify specific obligations, the current rule timeline, residency requirements, and current vendor evidence with legal counsel for your jurisdiction and customer mix. This article is a buyer aid, not legal advice.