Sub-Processor Addendum Template

SUB-PROCESSOR ADDENDUM

This Sub-Processor Addendum ("Addendum") is entered into on [Date] between:

[Processor Name] ("Processor"), acting on behalf of [Organization Name] ("Data Fiduciary") under the Data Processing Agreement dated [Date] ("DPA"),
AND
[Sub-Processor Name], having its registered office at [Address] ("Sub-Processor").

This Addendum is entered into pursuant to Clause [6] of the DPA, which requires the Processor to flow down equivalent obligations to any approved sub-processor, in furtherance of the Data Fiduciary's obligation under Section 8(2) of the DPDP Act, 2023 to ensure processing on its behalf is governed by valid contractual terms at every level.

1. BACKGROUND
The Data Fiduciary has approved the Processor's engagement of the Sub-Processor to perform [describe function, e.g., "cloud infrastructure hosting", "customer support ticketing", "SMS delivery"] in connection with the Processor's obligations under the DPA.

2. SCOPE OF SUB-PROCESSING
The Sub-Processor shall process the personal data categories described in Annexure A of the DPA solely to the extent necessary to perform the function described above, and for no other purpose.

3. FLOW-DOWN OBLIGATIONS
The Sub-Processor agrees to be bound by obligations no less protective than those imposed on the Processor under the DPA, including to:
   a. Process personal data only on documented instructions relayed by the Processor on behalf of the Data Fiduciary;
   b. Implement security safeguards (encryption, access control, activity logging) consistent with the standards set out in the DPA and the DPDP Rules, 2025;
   c. Bind its own personnel to confidentiality obligations;
   d. Not further sub-contract processing without written approval flowing back through the Processor to the Data Fiduciary;
   e. Notify the Processor of any Personal Data Breach without undue delay and in any event within [X hours], to enable the Processor and Data Fiduciary to meet the intimation timelines under Section 8(6);
   f. Assist with Data Principal rights requests (access, correction, erasure) as relayed by the Processor;
   g. Delete or return all personal data upon termination of the underlying function, and certify such deletion in writing.

4. LIABILITY
The Processor remains fully liable to the Data Fiduciary for the acts and omissions of the Sub-Processor as if they were the Processor's own, as provided under the DPA. Nothing in this Addendum creates a direct contractual relationship between the Sub-Processor and the Data Fiduciary, except for the Data Fiduciary's right to audit under Clause 5 below.

5. AUDIT RIGHTS
The Data Fiduciary, or its appointed auditor, may audit the Sub-Processor's compliance with this Addendum, either directly or through the Processor, on [X days'] written notice.

6. CROSS-BORDER PROCESSING
Where the Sub-Processor processes personal data outside India, such transfer must comply with Section 16 of the DPDP Act and any restrictions notified by the Central Government, and shall be documented in Annexure B.

7. TERMINATION
This Addendum terminates automatically upon termination of the DPA or upon the Data Fiduciary's withdrawal of approval for this Sub-Processor, whichever occurs first, subject to survival of data-return/deletion obligations.

8. GOVERNING LAW
This Addendum is governed by the laws of India and forms an integral part of the DPA referenced above.

IN WITNESS WHEREOF, the Parties have executed this Addendum as of the date first written above.

For [Processor Name]                              For [Sub-Processor Name]
Name: ______________________                     Name: ______________________
Title: ______________________                    Title: ______________________

Acknowledged by Data Fiduciary (approval of sub-processor engagement):
For [Organization Name]
Name: ______________________ Title: ______________________

ANNEXURE A: Description of Sub-Processed Data
ANNEXURE B: Cross-Border Transfer Details (if applicable)