Interactive Checklist

C-14 Third-Party & Supply Chain Procurement & Sourcing Lead

The Processor Contract Schedule Checklist

Procurement and legal contract review checklist enforcing mandatory statutory covenants in all Data Processing Agreements (DPAs) under Section 8(2).

Statutory Source: s.8(2) + Ch. 17: flow-down clauses, location-change notice, audit rights, deletion verification, ack artefacts

Total Verification Points: 7 Audit Checks

C-14s.8(2) + Ch. 17: flow-down clauses, location-change notice, audit rights, deletion verification, ack artefacts

The Processor Contract Schedule Checklist

The RFP annexex for any data vendor

Readiness Score

0 / 7 checks

Valid Contract Mandate: Written Data Processing Agreement (DPA) executed prior to sharing any personal data.

Section 8(2)

Purpose Limitation Clause: Processor restricted from processing personal data for any purpose other than instructions.

Section 8(2)

Sub-Processor Approval: Prohibition against engaging sub-processors without prior written authorization from Fiduciary.

Section 8(2)

Section 8(5) Security Safeguards Covenant: Processor warrants implementation of enterprise encryption, MFA, and access controls.

Section 8(5)

24-Hour Breach Notification SLA: Processor mandated to intimate Fiduciary of any suspected breach within 24 hours.

Section 8(6) & Rule 7

End-of-Contract Deletion Duty: Mandatory return or cryptographic erasure of all personal data upon contract termination.

Section 8(7)

Audit & Inspection Rights: Fiduciary retains statutory right to conduct independent security and compliance audits.

Section 8(1)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 8(1)

Section 8(2)

Section 8(5)

Section 8(6)

Section 8(7)

Statutory Context:

This checklist is directly anchored in s.8(2) + Ch. 17: flow-down clauses, location-change notice, audit rights, deletion verification, ack artefacts. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-004 Architecture Spec →

Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-08 Workpaper →

Control Dossier OBL-08

OBL-11 Workpaper →

Control Dossier OBL-11

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-13 — The Erasure Everywhere Checklist

Next Checklist

C-15 — The Transfer Flow Checklist