Data processing agreements with clients

Introduction

A Data Processing Agreement (DPA) is a legal contract between an organisation that determines the purpose and means of processing personal data and another organisation that processes such data on its behalf. It is particularly important in biotechnology, healthcare, pharmaceutical research, clinical trials, and digital health services, where organisations frequently share sensitive personal information.

For example, a pharmaceutical company may appoint a technology provider to store clinical trial records or process patient information. The agreement establishes the responsibilities of both parties and ensures that personal data is processed lawfully, securely, and only for authorised purposes.

DPAs help prevent misuse of information, clarify liability, and establish procedures for handling data breaches and regulatory investigations.

Legal framework governing data processing agreements

1. Digital Personal Data Protection Act, 2023 (India)

The DPDP Act establishes obligations for Data Fiduciaries and Data Processors. A Data Fiduciary determines the purpose and means of processing personal data, while a Data Processor processes it on behalf of the fiduciary.

Section 8 establishes important obligations concerning the processing of personal data, including responsibility for compliance and security safeguards. A Data Fiduciary may engage a Data Processor under a valid contract.

Accordingly, a DPA should clearly identify the processing activities, permitted purposes, security requirements, and responsibilities of the processor. The Act's application and specific obligations must also be considered alongside its commencement notifications and applicable rules.

2. Information Technology Act, 2000

The Information Technology Act provides additional protection for electronic information. Section 43A historically addressed compensation for failure by a body corporate to maintain reasonable security practices when handling sensitive personal data or information. Its present relationship with the DPDP Act must be assessed in light of the latter's commencement and repeal provisions.

Section 72 addresses breach of confidentiality and privacy by persons who obtain access to information under powers conferred by the Act. Organisations should also consider applicable rules and contractual confidentiality obligations.

3. General Data Protection Regulation (GDPR)

Article 28 of the GDPR requires a controller to use processors providing sufficient guarantees regarding appropriate technical and organisational security measures. It also requires a binding contract containing specific processing instructions and obligations.

The agreement should address confidentiality, security, subprocessors, assistance with data-subject rights, breach notifications, audits, and deletion or return of data.

Essential clauses of a data processing agreement

A properly drafted DPA should contain the following provisions:

Purpose and scope: Define the nature, duration, and purpose of processing.

Categories of data: Identify personal, financial, medical, genetic, or clinical information being processed.

Instructions: Require the processor to follow documented and lawful instructions.

Confidentiality: Ensure authorised personnel are bound by confidentiality obligations.

Security safeguards: Specify encryption, access controls, backups, monitoring, and security testing.

Subprocessors: Establish approval and contractual requirements before appointing third-party processors.

Data breach notification: Specify how quickly the processor must inform the client about a breach and cooperate with investigations.

Audit rights: Permit the client to verify compliance through appropriate audits and reports.

International transfers: Establish safeguards for transfers of personal data across jurisdictions.

Termination: Provide for secure deletion or return of data after the agreement ends, subject to lawful retention requirements.

Importance in biotechnology and healthcare

DPAs are particularly important when biotechnology companies outsource clinical trial management, genetic testing, laboratory information systems, cloud storage, or artificial intelligence-based analysis.

For example, a clinical research organisation may process patient records on behalf of a pharmaceutical company. The DPA should restrict the processor from using patient information for unrelated commercial purposes. It should also establish security requirements and procedures for reporting unauthorised access.

Biological samples themselves are not necessarily personal data in every circumstance, but information derived from identifiable samples, such as genetic or health records, may attract data protection requirements.

Relevant case laws

There are limited Indian judicial decisions directly dealing with modern DPAs. However, the following cases establish principles relevant to contractual responsibility, confidentiality, and personal data protection.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21. The judgment established the importance of protecting personal information against unnecessary collection and misuse. It provides a constitutional foundation for confidentiality and responsible data processing arrangements.

2. District Registrar and Collector, Hyderabad v. Canara Bank (2005)

The Supreme Court recognised the importance of privacy and confidentiality in personal and financial records. The decision is relevant when organisations handle confidential client information and determine the circumstances in which disclosure may be legally justified.

3. Shreya Singhal v. Union of India (2015)

The Supreme Court struck down Section 66A of the Information Technology Act as unconstitutional. Although the case was primarily concerned with freedom of expression, it demonstrates the importance of ensuring that digital regulation respects constitutional rights and legal safeguards.

4. Google Spain SL v. Agencia Española de Protección de Datos (2014)

The Court of Justice of the European Union examined the responsibilities of a search engine in processing personal information. The judgment illustrates the importance of identifying the legal responsibilities of organisations involved in processing personal data.

These cases provide supporting principles; they do not directly establish the mandatory contents of a DPA.

Legal consequences of non-compliance

Failure to comply with data processing obligations may result in regulatory penalties, contractual claims, compensation where legally available, and reputational damage. Under the GDPR, violations of processor-related obligations can attract significant administrative fines. Under India's DPDP framework, financial penalties may apply according to the statutory schedule and applicable enforcement provisions.

A client should therefore conduct due diligence before appointing a processor and regularly review the processor's security and compliance practices.

Conclusion

Data Processing Agreements are essential legal instruments for organisations that outsource or share personal data with third-party service providers. They define responsibilities, protect confidential information, establish security standards, and reduce disputes between clients and processors. In biotechnology and healthcare, carefully drafted DPAs are especially important because research activities may involve sensitive genetic, medical, and clinical information. A legally compliant agreement should clearly regulate processing purposes, security measures, breach reporting, subcontracting, audits, and termination procedures.