Intercompany Data Processing Agreement Template for India

The Intercompany Data Processing Agreement is essential for organizations operating in India that share and process personal data between group entities. This document becomes necessary when one group entity acts as a data controller and another as a data processor, ensuring compliance with Indian data protection laws, particularly the Digital Personal Data Protection Act 2023 and associated IT Rules. It establishes the framework for lawful data processing, defines security requirements, outlines breach notification procedures, and addresses data localization requirements. The agreement is particularly crucial given India's evolving data protection landscape and the increasing scrutiny of intra-group data transfers. It helps organizations demonstrate compliance with regulatory requirements while maintaining operational efficiency in their data processing activities.

1. Parties: Identification of the data controller and data processor entities, including registered addresses and company details

2. Background: Context of the agreement, relationship between the parties, and purpose of data processing

3. Definitions: Definitions of key terms aligned with Indian data protection laws, particularly the Digital Personal Data Protection Act 2023

4. Scope and Purpose: Detailed description of the data processing activities, types of data, and processing purposes

5. Obligations of the Data Processor: Processor's responsibilities including compliance with instructions, confidentiality, and security measures

6. Obligations of the Data Controller: Controller's responsibilities including lawful basis for processing and providing documented instructions

7. Security Measures: Technical and organizational security measures required under Indian law

8. Data Breach Notification: Procedures for reporting and handling data breaches as per Indian regulations

9. Audit Rights: Controller's rights to audit processor's compliance and processor's obligation to assist

10. Sub-processing: Conditions and requirements for engaging sub-processors

11. Term and Termination: Duration of the agreement and termination provisions

12. Data Deletion or Return: Obligations regarding data handling upon agreement termination

13. Liability and Indemnity: Allocation of risks and responsibilities between parties

14. Governing Law and Jurisdiction: Specification of Indian law as governing law and jurisdiction for disputes