Data Processor meaning: the clinic's vendor under DPDP Who counts as a processor, the section 8(2) contract rule, and why the clinic stays responsible.

A Data Processor, under section 2(k) of the Digital Personal Data Protection Act, 2023, is "any person who processes personal data on behalf of a Data Fiduciary". The Act's word "processing" (s.2(x)) covers "collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission" and more. So a clinic software vendor that stores the patient register, a cloud host that holds the database, an SMS gateway that sends tokens, or an accountant's firm that keys in receipts is each processing personal data for the clinic. The clinic that decides why and how the data is used is the Data Fiduciary; the patient is the Data Principal.

What does section 8(2) require between a clinic and its vendor?

A contract. Section 8(2) says: "A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract." The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) add what the contract should carry. Rule 6(1)(f) lists, among the reasonable security safeguards a Data Fiduciary must take, "appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor ... for taking reasonable security safeguards". For a small clinic that means the vendor's terms of service, or a signed agreement, must say what the vendor does to protect the data. Vendor terms that say nothing about security are the gap to close.

If the vendor loses the data, who is responsible?

The clinic, under the Act. Section 8(1) says a Data Fiduciary shall, "irrespective of any agreement to the contrary", be responsible for complying with the Act "in respect of any processing undertaken by it or on its behalf by a Data Processor". Section 8(5) requires the Data Fiduciary to protect personal data "in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor". The Schedule to the Act lists breach of s.8(5) at a penalty that "may extend to two hundred and fifty crore rupees". The clinic can recover from the vendor under its contract, but the Board looks to the clinic. Which questions to ask a vendor before signing are in our post on clinic software security questions under DPDP.

When does a processor stop being a processor?

When it starts deciding purpose and means itself. The Act's definitions turn on that one test: s.2(i) makes the person who "determines the purpose and means of processing" the Data Fiduciary. A vendor that uses prescription data for its own analytics, sells it to a pharma company or markets to the clinic's patients is no longer only acting on the clinic's behalf for that use. Whether that is permitted at all is a separate question for the vendor; for the clinic, it is a reason to read what the vendor's terms allow the vendor to do with the data.

Who are the processors of a typical one-doctor clinic?

When sections 8 and the Rules on security commence, each line in the table needs a contract that mentions security. The timeline is in our guide to the DPDP Act for clinics.