Cyber Security Clauses Every Vendor Contract Needs, with Model Text

Every contract with a vendor who touches your systems, data or payments (software firms, payroll agencies, admission portals, hospital IT providers, security and housekeeping contractors with access cards) should contain at least eight clauses: confidentiality, a data security standard, breach notification within a fixed number of hours, audit rights, a bank-detail change procedure with call-back, data return and deletion, control of sub-processors, and indemnity. From 13 May 2027, s.8(2) of the DPDP Act allows a Data Fiduciary to engage a Data Processor “only under a valid contract”, and s.8(1) keeps the institution responsible whatever the contract says.

Why the vendor contract is your security document

The admission portal is run by a software firm in Pune; payroll by an agency; the lab system by a cloud provider. When the vendor fails, the law holds the institution answerable.

Under DPDP Act s.8(1), the Data Fiduciary is responsible “irrespective of any agreement to the contrary”, including for processing by its Data Processor, and s.8(2) allows a processor “only under a valid contract”. The contract is the institution’s only lever over the vendor, and its evidence of reasonable care.

The vendor has its own exposure: under IT Act s.72A, a contractor who discloses personal information in breach of a lawful contract, with intent to cause or knowing it is likely to cause wrongful loss or gain, faces up to 3 years, or fine up to ₹5 lakh, or both. A clear confidentiality clause makes that breach easy to prove.

The eight clauses, and what each must say

1. Confidentiality. All data received; survives termination; binds the vendor’s staff.
2. Data security standard. A named standard (such as IS/ISO/IEC 27001) or a schedule of minimum controls mirroring Rule 6 of the DPDP Rules, 2025.
3. Breach notification. A fixed number of hours, shorter than the institution’s own 6-hour CERT-In window.
4. Audit rights. To audit, or receive an independent audit report.
5. Bank-detail change procedure. No change of the vendor’s account accepted on email alone.
6. Data return and deletion. On termination or when the purpose ends, return and then delete, with a written certificate. This supports the fiduciary’s duty under DPDP s.8(7)(b).
7. Sub-processors. No subcontracting of data processing without prior written consent, and flow-down of the same obligations.
8. Indemnity and cooperation with police, CERT-In and the Data Protection Board.

Model clause text (adapt with your lawyer)

Confidentiality. “The [Vendor] shall keep confidential all information and personal data received from or on behalf of the [Institution], shall use it only for the purposes of this Agreement, and shall ensure that its employees and agents are bound by equivalent obligations. This clause shall survive termination of this Agreement.”

Security. “The [Vendor] shall implement and maintain reasonable security safeguards, at a minimum those set out in Schedule [__], including encryption or masking of personal data, access control, logging of access for at least [one year], and tested backups, and shall comply with the [IS/ISO/IEC 27001 / named standard] or an equivalent standard.”

Breach notification. “The [Vendor] shall inform the [Institution]’s Nodal Officer by telephone and email within [2] hours of becoming aware of any actual or suspected personal data breach or cyber incident affecting the [Institution]’s data or systems, and shall provide all information required for reporting to CERT-In, the police and the Data Protection Board.”

Audit. “The [Institution] may, on [7] days’ notice, audit the [Vendor]’s compliance with this Agreement, or require an independent audit report not older than [12] months.”

Bank details. “Any request by the [Vendor] to change its bank account details shall be made in writing on the [Vendor]’s letterhead, signed by its authorised signatory. The [Institution] shall act on it only after confirming it by a telephone call to the [Vendor]’s number recorded in the [Institution]’s vendor file at the time of contract, and after approval of the [Designation]. The [Institution] shall not be liable for delay caused by such verification.”

Return and deletion. “Within [30] days of termination, or earlier on request, the [Vendor] shall return all personal data in [format] and thereafter delete all copies, and shall certify the deletion in writing, save where retention is required by law.”

Sub-processors. “The [Vendor] shall not engage any sub-processor without the [Institution]’s prior written consent, and shall impose on each sub-processor obligations no less protective than these.”

Indemnity. “The [Vendor] shall indemnify the [Institution] against all losses, penalties, compensation and costs arising from the [Vendor]’s breach of this clause or from any unauthorised disclosure by the [Vendor], its staff or sub-processors.”

Common mistakes

• Signing the vendor’s standard terms without checking liability caps and breach notification.
• A breach notification clause of “promptly” or “72 hours”, which cannot support a 6-hour CERT-In report.
• No exit plan: the contract ends and the vendor still holds five years of student data.
• Accepting a bank-change request on an email that looks right. That is how vendor bank-change fraud succeeds.
• Forgetting small vendors, such as the agency running CCTV.

Frequently asked questions

If the vendor causes the breach, is the institution off the hook?

No. Under DPDP Act s.8(1), the Data Fiduciary remains responsible. The indemnity lets you recover from the vendor; it does not shift regulatory liability.

Do government tenders need these clauses?

Yes. The DPDP Act applies to government bodies unless specifically exempted, from 13 May 2027. Build the clauses into tender documents and the standard contract now.

What is a “Data Processor”?

Under the DPDP Act, a person who processes personal data on behalf of a Data Fiduciary. A payroll agency or a hosted admission portal is a typical example.

Quick quiz

For procurement, legal, accounts and IT staff: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Digital Personal Data Protection Act, 2023: ss.8(1), 8(2), 8(5), 8(6), 8(7)
• Digital Personal Data Protection Rules, 2025: Rule 6
• Information Technology Act, 2000: ss.43A, 72A, 85
• IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: Rule 8
• CERT-In Directions under s.70B(6) of the IT Act, dated 28 April 2022

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.