Who is responsible for data protection in a subcontract?

Agency pushes all data protection liability to you? Understand DPDP Act duties, ask for a clear data processing agreement and shared responsibility.

The risky clause

Subcontractor is solely responsible for any data breach, regulatory penalty and client claim arising from the project, without limit.

Why it is dangerous

India's Digital Personal Data Protection Act 2023 sets duties for those who handle personal data, and roles between controller and processor matter. A fair contract has a data processing agreement, defined security measures, prompt breach notice and liability proportional to your role and fees. Ask a lawyer for current rules and phasing. This is general information, not legal advice.

Safer clause to propose

The parties will sign a data processing agreement. Subcontractor will follow agreed security measures and notify Agency of breaches within 48 hours. Liability for data incidents is capped at [fees paid].

Message to send

Hi [Agency],

Could we add a data processing agreement with defined security measures and breach notice, and cap my liability at fees paid? Thanks, [Your Name]

Frequently asked questions

Does the DPDP Act affect subcontractors?

It can, depending on how you process personal data. Take legal advice on your role.

What goes in a DPA?

Purpose, security measures, breach notice, sub-processors and deletion.

Home Scanner Scope Guard Payment Chaser Sample report Pricing Earn 30%Guides Risk calculator Clause library Privacy Terms