Vendor / Partner Data Sharing Notice

VENDOR / PARTNER DATA SHARING NOTICE

Issued by: [Organization Name] ("we", "us", the Data Fiduciary)
Vendor/Partner: [Vendor/Partner Name]
Effective Date: [Effective Date]

1. WHY YOU ARE RECEIVING THIS NOTICE
We are providing this itemised notice, as required under Section 5 of the DPDP Act, 2023, because we intend to share your personal data with [Vendor/Partner Name] ("the Partner") to deliver [describe service, e.g., "installation services", "insurance underwriting", "co-branded loyalty rewards"] to you.

2. DATA CATEGORIES TO BE SHARED
   - [Data Category 1, e.g., Name and contact details]
   - [Data Category 2, e.g., Address for service fulfilment]
   - [Data Category 3, e.g., Purchase/transaction history relevant to the partnership]
No data beyond what is listed above will be shared with the Partner without a fresh notice and, where required, fresh consent.

3. PURPOSE OF SHARING
[State specific purpose, e.g., "to enable the Partner to schedule and carry out installation of the product you purchased" / "to enable the Partner to process your insurance claim"]. This is the sole purpose for which the Partner is authorised to use your data.

4. LEGAL BASIS
   [ ] This sharing is based on your consent (Section 6), sought separately below.
   [ ] This sharing is necessary for performance of the contract/service you requested from us and falls within the scope of data you voluntarily provided for that purpose (Section 7(a)).
[Select and retain the applicable basis; if consent-based, include the consent capture block in Section 5.]

5. CONSENT (where applicable)
   [ ] I consent to [Organization Name] sharing the data listed in Section 2 with [Vendor/Partner Name] for the purpose stated in Section 3.
This consent is specific to this Partner and this purpose and does not extend to any other third party or purpose.

6. PARTNER'S OBLIGATIONS
[Vendor/Partner Name] is contractually bound under a Data Processing Agreement / Data Sharing Agreement to: (a) use your data solely for the stated purpose, (b) implement reasonable security safeguards, (c) not further share your data without authorisation, (d) assist us in fulfilling your rights requests, and (e) notify us promptly of any personal data breach, consistent with our obligations under Section 8 of the DPDP Act.

7. CROSS-BORDER TRANSFER
[State if applicable: "The Partner processes data on servers located in [Country/Region]. This transfer is undertaken in compliance with Section 16 of the DPDP Act and any applicable Government notifications restricting transfers to specific countries."] [If not applicable, state: "The Partner processes data exclusively within India."]

8. RETENTION BY PARTNER
The Partner is required to retain shared data only for [retention period] and to erase or return it to us upon completion of the stated purpose or upon our instruction.

9. YOUR RIGHTS
You may withdraw consent (if consent-based) at any time via [mechanism], and may exercise your rights of access, correction, and erasure (Sections 11-12) by contacting us — we will coordinate with the Partner as necessary.

10. CONTACT
Grievance Officer / DPO: [Name], [Email Address]

Data Principal acknowledgement: ______________________ Date: ______________