Introduction. 

Most organisations today do not process personal data entirely on their own. A company may collect personal data directly from its customers but rely on other organisations to provide the services necessary to store, manage, analyse or otherwise process that data. For example, an organisation may use a customer relationship management platform to manage customer information, a cloud provider to store data, a payroll service to process employee information or a marketing platform to communicate with customers. 

The Digital Personal Data Protection Act, 2023 (DPDP Act) provides the legal framework for understanding these relationships. It defines a Data Fiduciary as a person who determines the purpose and means of processing personal data, while a Data Processor processes personal data on behalf of such Data Fiduciary. In practice, data processing relationships often extend beyond this primary Fiduciary-Processor relationship, involving multiple layers of external service providers. This raises an important question such as who are these third and fourth-party vendors. Let’s see in detail.  

Who are third- and fourth-party vendors? 

Third-party vendors are external organisations engaged by a Data Fiduciary to provide services involving personal data. Where such a vendor processes personal data on behalf of the Data Fiduciary, it may qualify as a Data Processor under the DPDP Act. However, whether a vendor qualifies as a Data Processor depends on its role and the nature of the processing activities. 

Whereas Fourth-party vendors are organisations engaged by a third-party vendor to provide services further down the data-processing chain. The DPDP Act does not specifically define the term “fourth party”; it is an operational term used to describe entities involved in processing through a primary vendor. A fourth-party vendor may not have a direct contractual relationship with the Data Fiduciary but may still have access to or process personal data as part of the broader processing chain.  

Why is there a need to regulate third- and fourth-party vendors? 

Regulating third and fourth-party vendors is important because personal data may pass through multiple organisations during processing, increasing the risk of data breaches, unauthorised access, misuse, and loss of control over personal data. While the Data Fiduciary remains responsible for ensuring appropriate protection of personal data, it may not have direct visibility or control over every organisation involved in the processing chain. Clear contractual requirements, due diligence, security measures, and oversight of vendors help ensure that personal data remains protected throughout the entire processing chain 

Steps of Effective Vendor Governance:  

The organisations should take the following steps to ensure vendor governance. The first step is knowing where personal data goes. An organisation should:  

• Map the Data Flow and Assess the risk: Organisations should begin with a vendor data inventory, rather than a simple list of suppliers to ensure efficient management of Vendor risk, be it third party or fourth party. This inventory should then be translated into a data-flow map. A practical risk assessment for each vendor must also be done and should include the nature of processing done by them. The objective is not to eliminate all third-party risk. It is to ensure that the organisation understands where its material privacy and security risks sit before entering or renewing a vendor relationship. Once the data flow and risk profile are understood, the next layer is contractual control. 

  
  

• Embed DPDP Safeguards in Vendor Contracts: Section 8(2) of the DPDP Act requires a Data Fiduciary to engage a Data Processor for processing on its behalf only under a valid contract. Section 8(4) also requires appropriate technical and organisational measures to ensure effective observance of the Act and the Rules. Section 8(5) extends the Data Fiduciary’s security responsibility to processing undertaken on its behalf by a Data Processor. Further, the DPDP Rules clarify what includes as  reasonable security safeguards. These may include measures such as encryption, access controls, monitoring for unauthorised access and data backups.  

  
  

• Stay in control of dynamics by monitoring vendors: A vendor’s security posture can change after onboarding, since the task of data processing is a dynamic one. It may introduce a new sub processor, migrate infrastructure, modify its access model, acquire another company or experience a security incident. A contract that was adequate when signed may not address the risk created by changes that happen over time. Organisations should therefore adopt a risk-based vendor monitoring programme. 

  
  

• Data Retention, Deletion and Vendor Exit: Data may remain in production systems, backups, test environments, archives or downstream platforms like former employees may retain access credentials. The DPDP Act under Section 8(7), read along with the DPDP Rules, addresses this lifecycle problem directly, requiring a Data Fiduciary to erase personal data after the Data Principal’s withdrawal of consent or the specified purpose is no longer being served, whichever is earlier. The Data Fiduciary must also cause its Data Processor to erase personal data that was made available for processing. The key principle is that data governance should have an exit plan from the beginning.  

Conclusion & Suggestion 

Effective DPDP readiness therefore requires more than just updating vendor agreements. Organisations need to know where personal data travels, understand who can access it, impose appropriate contractual safeguards, monitor vendor and fourth-party activity, prepare for incidents and ensure that personal data does not remain indefinitely after its purpose or the vendor relationship ends. Vendor governance is therefore best approached as a data lifecycle discipline.  

The six interconnected stages of such a vendor privacy lifecycle are as follows. 

• Firstly, the mapping of the data flow is done. The organisation identifies vendors, downstream providers and how the data is being transferred from one stage to another. 

  
  

• Secondly, the assessment of mechanisms that were put into place to ensure privacy, security and operational risk associated with each stage. 

  
  

• Thirdly, the risks associated with processing are converted into enforceable obligations through contracts to ensure security, manage incidents, provide rights assistance and ensure deletion. 

  
  

• Fourthly, an organisation monitors the vendors to verify that they meet their obligations. 

  
  

• Fifthly, the organisation activates predefined escalation and remediation processes to ensure prompt incident response to adversaries. 

  
  

• Lastly, data, credentials and access are withdrawn in a controlled manner, with appropriate evidence of deletion or return. 

Want to Stay Ahead?    

Reach out to the experts at Gotrust today.