Every clause your vendor's DPA needs before DPDPA enforcement

A Data Processing Agreement that was fine under a generic privacy policy isn't automatically fine under DPDPA. The obligations a Data Fiduciary carries flow through to every processor touching that data, so the agreement needs to say so explicitly.

What to check before signing

• Purpose limitation — the processor can't use data for anything beyond the stated engagement
• Sub-processor disclosure and approval rights, not a blanket 'may engage subcontractors' clause
• Breach notification terms that give you enough runway to still hit your own 72-hour window
• Data return or deletion obligations at contract end, with a verifiable method, not just a promise

None of this is exotic — it's the same due diligence GDPR-era Data Processing Agreements already required. The difference is that under DPDPA, you need to be able to produce the signed agreement, not just point to a clause you believe exists.