What is the deadline for DPDP Act enforcement in India?

Hard enforcement for the Digital Personal Data Protection (DPDP) Act begins on May 13, 2027. The transition window is currently active.

What are the penalties under the DPDP Act?

Penalties range from ₹50 Crores for general violations to ₹250 Crores for failure to take reasonable security safeguards.

How much does DPDP compliance cost?

Market rates for comprehensive DPDP compliance range from ₹3-7 Lakhs for SMEs to ₹15+ Lakhs for enterprises. This includes awareness training, data audit, DPA deep-dive sessions, consent manager setup, and ongoing DPO support.

Does DPDP apply to small businesses?

Yes. The DPDP Act makes no distinction based on turnover. Even if you have 100 customers, if you collect digital personal data, you are a Data Fiduciary and must comply.

What is included in a DPDP compliance workshop?

A DPDP readiness workshop typically includes: understanding the DPDP Act, mapping your tech stack, reviewing data processor agreements, checking consent flows, and creating a clear action plan.

Checklist•5 min read

DPDP Vendor List Prep Checklist for Indian Businesses

Prepare your vendor list for DPDP compliance. Use this checklist to identify data processors, assess contracts, and manage third-party data risks.

Sushant Pasumarty15 July 2026

DPDP Vendor List Prep Checklist

Preparing a comprehensive vendor list is essential for DPDP compliance. Data Fiduciaries are responsible for ensuring that all third-party Data Processors handle personal data in line with the Act.

This checklist helps Indian business founders, CXOs, and compliance officers systematically identify, categorize, and prepare their vendor relationships for DPDP. Each item includes the action, responsible role, estimated time, and potential external costs.

Phase 1: Identification & Initial Inventory

Action: Identify all third-party vendors. This includes SaaS providers, cloud hosts, payment gateways, marketing agencies, HR platforms, logistics partners, and any service that touches personal data. Owner: CTO/IT Head & Procurement. Time: 1-2 weeks. Cost (external): Part of Data Mapping (₹1.5L – ₹3L). MBS Tier: Data Mapping.
Action: Determine which vendors process personal data. Filter the full vendor list to focus only on those that receive, store, transmit, or otherwise handle personal data on your behalf. Owner: CTO/Compliance Officer. Time: 3-5 days. Cost (external): Included in Data Mapping. MBS Tier: Data Mapping.
Action: Categorize personal data handled by each vendor. For each data-processing vendor, identify the types of personal data (e.g., customer names, email, Aadhaar, PAN, financial details, health data). Owner: Compliance Officer/Product Head. Time: 1 week. Cost (external): Included in Data Mapping. MBS Tier: Data Mapping.
Action: Document the purpose of data processing for each vendor. Clearly define why each vendor needs access to specific personal data and how it aligns with your stated purposes for collecting that data. Owner: Compliance Officer/Business Unit Head. Time: 3-5 days. Cost (external): Included in Data Mapping. MBS Tier: Data Mapping.
Action: Map data flows to and from each vendor. Visualize how personal data moves between your systems and each vendor's systems, including transfer mechanisms and storage locations. Owner: CTO/IT Head. Time: 1-2 weeks. Cost (external): Included in Data Mapping. MBS Tier: Data Mapping.

Phase 2: Assessment & Gap Analysis

Action: Review existing vendor contracts (DPAs). Examine current agreements for data protection clauses, liability, breach notification, audit rights, and data principal rights support. Owner: Legal Head/Compliance Officer. Time: 2-3 weeks (ongoing). Cost (external): Legal counsel (variable), or part of DPDP Readiness Audit (₹2L – ₹6L). MBS Tier: DPDP Readiness Audit.
Action: Identify gaps in current vendor contracts against DPDP requirements. Pinpoint where existing Data Processing Agreements (DPAs) or standard terms fall short of DPDP compliance. Owner: Legal Head/Compliance Officer. Time: 1 week. Cost (external): Legal counsel, or part of DPDP Readiness Audit. MBS Tier: DPDP Readiness Audit.
Action: Assess vendor's security measures and compliance posture. Evaluate each critical vendor's information security certifications (e.g., ISO 27001), data breach history, and stated DPDP readiness. Owner: CISO/CTO. Time: 2-3 weeks (ongoing). Cost (external): Security audit firm (variable), or part of DPDP Readiness Audit. MBS Tier: DPDP Readiness Audit.
Action: Prioritize vendors based on data risk. Rank vendors by the volume, sensitivity, and impact of personal data they process. Focus remediation efforts on high-risk processors first. Owner: Compliance Officer/Risk Team. Time: 3-5 days. Cost (external): Part of DPDP Readiness Audit. MBS Tier: DPDP Readiness Audit.

Phase 3: Remediation & Ongoing Management

Action: Draft or update Data Processing Agreements (DPAs). Develop robust DPAs that explicitly define responsibilities, security obligations, data principal rights support, breach notification protocols, and data retention/deletion policies. Owner: Legal Head/Compliance Officer. Time: 4-6 weeks (ongoing). Cost (external): Legal counsel (variable), or part of Full DPDP Consulting (₹7L – ₹12L). MBS Tier: DPDP Workshop or Full DPDP Consulting.
Action: Implement a vendor due diligence process. Establish a formal process for vetting new vendors for DPDP compliance before engagement and conducting periodic reviews of existing ones. Owner: Procurement/Compliance Officer. Time: 1-2 weeks (setup). Cost (external): Part of Full DPDP Consulting. MBS Tier: Full DPDP Consulting.
Action: Train relevant internal teams on vendor data management. Educate procurement, IT, legal, and business unit heads on their roles in ensuring vendor compliance. Owner: HR/Compliance Officer. Time: 2-3 days (per session). Cost (external): Part of Full DPDP Consulting. MBS Tier: Full DPDP Consulting.

💡 Key Insight: A robust vendor list is dynamic. Regular audits and updates are critical, especially as your business engages new partners or changes data processing activities.

What This Costs: DIY vs. Meridian Bridge Strategy

Preparing your vendor list for DPDP compliance can be managed internally or with external expert support. The cost and duration depend on the complexity of your vendor ecosystem and the resources you commit.

Approach	Description	Cost Range	Duration	MBS Tier Equivalent
DIY	Internal teams handle all identification, assessment, and contract updates. Requires dedicated legal, IT, and compliance resources.	₹0 – ₹1.5L (internal staff time + basic tools)	Months (variable)	None directly, but foundational work for all MBS tiers.
MBS Data Mapping	Sushant Pasamarty and MBS map all personal data flows, identifying vendors and the data they touch. This covers initial identification and data categorization.	₹1.5L – ₹3L	1-2 weeks	Data Mapping
MBS DPDP Readiness Audit	Builds on Data Mapping. Includes a gap analysis of your existing vendor contracts and an assessment of your high-risk data processing vendors against DPDP.	₹2L – ₹6L	2-4 weeks	DPDP Readiness Audit
MBS DPDP Workshop	Includes Data Mapping, Gap Analysis, and provides a prioritized 90-day roadmap for addressing vendor compliance, including DPA updates.	₹5L – ₹10L	4-6 weeks	DPDP Workshop
MBS Full DPDP Consulting	Comprehensive support from initial mapping through DPA implementation, vendor due diligence process setup, and DPO training on vendor oversight.	₹7L – ₹12L	3-6 months	Full DPDP Consulting

✅ Pro Tip: Many organizations underestimate the time and expertise required for DPA negotiation. External legal or compliance support can accelerate this critical phase.

Next Step: Estimate Your Specific DPDP Compliance Cost

Understanding your vendor landscape is a significant step towards DPDP compliance. Use our free calculator to get a tailored estimate for your business’s overall DPDP compliance journey. Then, book a call with Sushant Pasamarty, founder of Meridian Bridge Strategy, to discuss your specific vendor list challenges and how MBS can help.

Frequently Asked Questions

What is a 'Data Processor' under DPDP, and why is identifying them critical?

A Data Processor is any entity (like a vendor) that processes personal data on behalf of a Data Fiduciary. Identifying them is critical because the Data Fiduciary (your business) remains responsible for their compliance with DPDP, requiring due diligence and proper contracts.

How does this vendor checklist differ from a general DPDP readiness checklist?

This checklist specifically focuses on your third-party vendor relationships and their role in your DPDP compliance. While a general readiness checklist covers internal processes, this one zeroes in on external data processing arrangements, Data Processing Agreements (DPAs), and vendor risk.

When should my business consider the 'Full DPDP Consulting' service for vendor management?

Consider Full DPDP Consulting if your business has a large, complex network of vendors, processes sensitive personal data, or lacks internal legal and compliance resources to draft and negotiate numerous Data Processing Agreements and set up robust vendor due diligence processes effectively.

Check Your DPDP Cost

Use the free calculator to estimate your compliance cost. Then book a call with Sushant to scope the right engagement.

Estimate My DPDP Cost →

Or book a call with Sushant →