Data protection, processor engagement clause set

11. DATA PROTECTION

11.1 Definitions and roles. In this clause, “Personal Data”, “Data Fiduciary”, “Data Processor”, “Data Principal” and “personal data breach” have the meanings given in the Digital Personal Data Protection Act 2023 (the “DPDP Act”). “Data Protection Laws” means the DPDP Act and the rules made under it as and when brought into force, the Information Technology Act 2000 and the rules made under it including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 for so long as they remain in force, and the directions issued by the Indian Computer Emergency Response Team under s.70B(6) of that Act, in each case as in force from time to time.

The Parties record that, in relation to the Personal Data described in Part 1 of Schedule [Schedule number: data processing], the Customer is the Data Fiduciary and the Supplier is the Data Processor. In relation to the categories of Personal Data described in Part 2 of that Schedule, being the Supplier’s own employee records, its billing and statutory records and the contact details of the Customer’s personnel processed for the administration of this Agreement, the Supplier acts as a Data Fiduciary in its own right and is solely responsible for compliance in respect of them. Schedule [Schedule number: data processing] sets out for each category the nature and purpose of the processing, the types of Personal Data, the categories of Data Principals, the duration, and the locations of processing.