You can outsource processing. Not accountability.
Avaril keeps a record of every vendor that handles personal data for you (what they get, under which contract, and where) so you can show you stayed in control.
What counts as a vendor under DPDP
The Act doesn't say “vendor”. You're the Data Fiduciary; anyone handling personal data on your behalf is a Data Processor: your cloud host, CRM, analytics tool, support desk, email or SMS sender. A supplier that never touches personal data isn't one.
Why it matters
Signing a contract doesn't hand off the obligation.
The Act holds you responsible for processing done on your behalf, whatever your agreement says (s.8(1)).
A vendor's breach is yours to report.
You must keep personal data secure even when a vendor holds it, and you're the one who notifies the Data Protection Board and the people affected (s.8(5), 8(6)).
The penalty ceiling is ₹250 crore.
Failing to take reasonable security safeguards can draw a penalty of up to ₹250 crore; failing to report a breach, up to ₹200 crore. Those are ceilings the Board applies case by case.
How Avaril helps you show you stayed in control
Onboard with the contract in view
Six guided steps flag what's missing as you go (no DPA, no sub-processor agreement), and Avaril drafts processing activities from your vendor's DPA.
A missing contract shows up at onboarding, not in an audit.
Map what each vendor holds
See which data categories each vendor handles, per service, with volume and retention.
You can't secure or erase data you haven't mapped.
Assess, evidence, sign off
Answer a control checklist with evidence, get a score and risk tier, and have your DPO approve or reject.
A written record that you checked, not just trusted.
See where the data goes
Record where each vendor processes, stores and hosts data, and what your contract says about transfers out of India.
“Does any vendor send data there?” gets a documented answer.
Keep the trail
Every vendor change (onboarded, assessed, reviewed, reported) is logged with who and when.
When someone asks how you oversee processors, you can show them.
Share the outcome
Publish a report link showing score, risk tier and evidence level that a customer or auditor can open without an account.
Show where a vendor stands without forwarding spreadsheets.
guided onboarding steps
data categories you can map
gap checks during onboarding
Common questions
Is every vendor a Data Processor?
No. A Data Processor handles personal data on your behalf. A supplier that never touches personal data isn't one, and in Avaril you record “DPA not required” with the reason. A vendor that decides its own purposes for the data can be a Data Fiduciary in its own right, which calls for a different kind of agreement. Avaril has a Joint Fiduciary type for that, and it's worth confirming with your counsel.
Does DPDP require a vendor register or risk score?
No. The Act requires a valid contract with each processor, reasonable security safeguards, breach reporting, and erasure that reaches processors. It doesn't prescribe a register, a score or a DPA format. Avaril's register, assessments and audit trail are how you can show you met those obligations.
Do my vendors need to be on Avaril?
No. If a vendor is on Avaril, onboarding starts pre-filled from its published profile. If it isn't, you add it yourself and attest that the details are yours, so they're marked as client-provided rather than verified by Avaril.
Is it allowed to send data abroad through a vendor?
Generally yes. The Act allows transfers unless the government restricts a specific country. Avaril lets you record where each vendor processes your data. It doesn't track which countries the government restricts.
Does Avaril verify what my vendors tell me?
Only where evidence backs it. Avaril records the evidence you attach and marks self-reported answers as self-reported. It doesn't independently audit your vendors.
Build Privacy Governing Workflows Faster business-ready?
Built for Startups and MSMEs navigating Privacy legal compliance, privacy operations, and consent management at scale.
No spam, ever. We'll only send you product updates.