01 · Definition
What is a data processing agreement?
A data processing agreement (DPA) is the contract between an organisation that controls personal data — a data fiduciary under India's Digital Personal Data Protection Act, a controller under the GDPR — and a data processor that handles that data on its behalf: a BSP running the WhatsApp inbox and campaigns, a CRM, a chatbot or cloud host, a support outsourcer. It says what the processor may do with the data and nothing more, how the data is protected, who else may touch it, what happens when something goes wrong and how the data comes back or is destroyed when the work ends. It is often signed as an addendum to the main service agreement.
The GDPR is specific about the contents. Article 28(3) requires the contract to set the subject matter, duration, nature and purpose of processing and the types of data and people concerned, and to bind the processor to act only on documented instructions (including on transfers), keep staff under confidentiality, apply article 32 security, use sub-processors only with authorisation and on the same terms, help the controller answer rights requests and meet its security, breach and impact-assessment duties, delete or return the data at the end, and allow audits. India's DPDP Act is shorter: a data fiduciary may engage a processor only under a valid contract (section 8(2)), and it remains responsible for what the processor does (section 8(1)) — so the duties to protect data, report breaches and erase on withdrawal reach the processor only through the DPA.
On WhatsApp there are usually two layers. Meta, which hosts the Cloud API, acts as a data processor for message content under the Meta Global Processor Terms, which sit alongside its WhatsApp Business Platform terms. Your Business Solution Provider (BSP) needs its own DPA covering the systems it runs — inbox, contact store, campaign logs, chatbot memory — and listing Meta and its other sub-processors. A DPA is different from an NDA, which only keeps information secret, and from the master agreement, which covers price and service levels.
Key takeaways
- A data processing agreement (DPA) is the contract that lets a vendor process personal data for a business, on that business's instructions.
- GDPR article 28(3) lists what it must contain: instructions, confidentiality, security, sub-processors, help with rights and breaches, deletion and audits.
- India's DPDP Act requires a valid contract before a data fiduciary uses a data processor (section 8(2)) and leaves responsibility with the fiduciary.
- With a WhatsApp BSP, the DPA should list Meta and every other sub-processor, their locations and a breach-notice deadline in hours.
- A DPA is not an NDA: confidentiality is one clause of it, not the whole job.
02 · Specifications
A data processing agreement: key facts and limits
| GDPR basis | Article 28(3) lists mandatory contents |
|---|---|
| DPDP basis | Processor only under a valid contract (s. 8(2)) |
| Responsibility in India | Stays with the data fiduciary (s. 8(1)) |
| GDPR sub-processors | Only with prior written authorisation (art. 28(2)) |
| Processor breach duty (GDPR) | Tell the controller without undue delay (art. 33(2)) |
| Typical form | Addendum to the main service agreement |
03 · Operation
How does a data processing agreement work?
Map what the vendor will touch
List the data (numbers, names, chats, media, order details), the people it concerns, the purposes and the systems, so the DPA describes the real processing, not a generic one.
Start from a sound template
Use the vendor's DPA or your own, but check it against GDPR article 28(3) clause by clause; it also covers what the DPDP Act expects in practice.
Negotiate the clauses that bite
Breach notice in hours, a sub-processor list with locations and advance notice of changes, deletion timelines and certificates, and audit rights you can actually use.
Cover transfers
Where data leaves India or the EU, name the destinations and the mechanism — standard contractual clauses for EU data — and forbid moves without notice.
Operate it, then review it
Keep the sub-processor list current, test a deletion request end to end and re-read the DPA when the vendor adds features such as AI or new hosting regions.
04Playground
A working model of DPA. Use its controls to replay it step by step.
Check a DPA clause by clause
10/10
ticked
- Required
- 9 / 9
- Optional
- 1 / 1
This DPA covers the essentials
Every item ticked.
This DPA covers the essentials. 10 of 10 ticked.
05 · Cautions
Common mistakes with a data processing agreement
Leaving breach notice open-ended
"Without undue delay" gives you no date to plan around. Set a deadline in hours that leaves you time to meet CERT-In's six hours and the DPDP and GDPR duties.
No sub-processor list
Without one you cannot tell customers or regulators where their data goes. Require a named list with locations and advance notice before any change.
Silence on the vendor's own uses
Product analytics or model training on your customers' chats makes the vendor a fiduciary for that use. Forbid it unless you have agreed and told customers.
Signing and filing
A DPA nobody operates is just paper. Test deletion, review the sub-processor list yearly and check the vendor's security evidence against what was promised.
06 · Worked example: A Jaipur jeweller's BSP contract
Example: A Jaipur jeweller's BSP contract
A Jaipur jeweller moves its WhatsApp catalogue and support to a new BSP. Before signing, its compliance lead marks up the BSP's standard DPA: the breach clause changes from "without undue delay" to "within 12 hours of discovery"; the sub-processor annex gains the cloud region and the AI vendor behind the chatbot; a clause bars using customer chats to train shared models; and deletion is set at 30 days after termination, with a written certificate. Six months later, a customer withdraws consent and asks for erasure — the jeweller sends one instruction and receives the BSP's confirmation that the inbox history and campaign lists were purged.
07 · Rationale
Why does a data processing agreement matter?
The DPA is where your legal duties become the vendor's working rules. If it does not require breach notice within a set number of hours, you may learn of a leak from the press; if it does not list sub-processors, customer chats can end up with a model provider you never approved; if it does not cover deletion, a consent withdrawal stops at your database while copies live on in the BSP's exports. Enterprise customers increasingly ask to see this contract before they let any vendor near their data.
08 · Questions and answers
DPA FAQs
- Do I need a DPA with my WhatsApp BSP?
- Yes, in practice. The BSP processes your customers' data on your behalf, so the GDPR requires an article 28 contract and the DPDP Act a valid contract; a DPA is how both are usually met.
- Is a data processing agreement mandatory under India's DPDP Act?
- A contract is. Section 8(2) lets a data fiduciary use a data processor only under a valid contract. The Act does not use the term DPA or list clauses, but the fiduciary stays liable, so the contract must carry its duties to the processor.
- What is the difference between a DPA and an NDA?
- An NDA only keeps shared information confidential. A DPA governs how a vendor may process personal data — instructions, security, sub-processors, breach notice, rights requests, deletion and audits — and confidentiality is just one of its clauses.
- Does Meta sign a DPA for the WhatsApp Cloud API?
- Meta covers its role in its own terms. It acts as a data processor for Cloud API messages under data processing terms offered alongside its WhatsApp business terms; your BSP's DPA should cover everything the BSP itself runs.
09 · Recommended practice
Best practices for a data processing agreement
- Keep one register of all DPAs with their breach deadlines and sub-processor lists.
- Ask the BSP which parts of the stack Meta's own terms cover and which the BSP is responsible for.
- Align the DPA's deletion clause with your data retention schedule.