1. Introduction

Offsite storage vendor controls refer to the legal, contractual, technical and operational measures an organisation uses when engaging an external vendor to store, preserve, retrieve, transport, archive or destroy its physical or electronic records outside its own premises.

These controls are especially important for HR departments, legal teams, payroll functions, financial institutions, hospitals, manufacturing companies and multinational businesses because outsourced records may contain confidential employee information, salary details, employment contracts, disciplinary files, medical records, litigation documents, identity information and commercially sensitive material.

The primary objective is to ensure that outsourcing record storage does not result in loss of control over records, unlawful disclosure, unauthorised destruction, regulatory non-compliance or an inability to produce evidence during an investigation or legal proceeding.

This explanation focuses on Indian law, particularly employment records, contractual liability, data protection, evidence preservation and vendor governance.

2. Meaning and scope of offsite storage vendor controls

Offsite storage vendor controls encompass the measures used throughout the lifecycle of records held by a third-party storage provider.

Examples include:

Physical storage of employee files, payroll registers, attendance records and personnel documents.

Electronic archiving of HR databases, scanned documents and email records.

Storage of litigation files, investigation materials and disciplinary proceedings.

Transport of confidential files between an employer's premises and a storage facility.

Retention, retrieval, return and destruction of records under approved schedules.

Use of subcontractors, cloud repositories, document-scanning providers or disaster-recovery facilities.

A storage vendor may be responsible for custody and physical security, but the employer may continue to bear legal obligations relating to statutory retention, confidentiality, employment compliance and the production of records to regulators or courts.

Core principle: Outsourcing custody is not equivalent to outsourcing accountability.

3. Legal framework in India

A. Indian Contract Act, 1872

The contract between the employer and storage vendor should define the services, security requirements, liability allocation, breach notification, inspection rights, subcontracting restrictions and termination obligations.

Sections 37 and 73 are relevant to performance of contractual obligations and compensation for breach. Depending on the circumstances, other provisions may also govern indemnities, contractual interpretation and enforceability.

A vague agreement stating only that the vendor will “store documents safely” may be inadequate for sensitive HR or litigation records.

B. Digital Personal Data Protection Act, 2023

Where the stored records contain digital personal data, the DPDP Act and applicable implementing provisions must be assessed according to their commencement and applicability.

Relevant issues include:

The organisation's obligations as a Data Fiduciary, where applicable.

The vendor's role as a Data Processor, where applicable.

Appropriate security safeguards.

Management of personal-data breaches.

Retention and erasure obligations, subject to applicable legal retention requirements.

Contractual arrangements governing processing by vendors.

The precise requirements depend on the provisions in force and the processing arrangement. Physical files may also be subject to other confidentiality, employment and sector-specific obligations.

C. Information Technology Act, 2000

Section 43A historically addressed compensation for failure to maintain reasonable security practices in specified circumstances involving sensitive personal data or information. Its present applicability must be assessed alongside the DPDP Act and the relevant commencement and repeal framework.

Sections 72 and 72A may be relevant to unauthorised disclosure in circumstances covered by those provisions. Organisations should not assume that every storage incident automatically satisfies the statutory elements of these offences.

D. Bharatiya Sakshya Adhiniyam, 2023

The Bharatiya Sakshya Adhiniyam governs evidentiary issues, including the admissibility of electronic records under its applicable provisions.

Where stored records may be used in employment litigation, regulatory investigations or commercial disputes, organisations should preserve authenticity, provenance, integrity and the information needed to establish how a record was created, stored, transferred and retrieved.

E. Employment and sector-specific laws

Depending on the organisation, additional requirements may arise under labour legislation, company-record requirements, tax laws, banking regulations, insurance regulations, medical confidentiality obligations and litigation-preservation duties.

For example, an employer cannot rely solely on a vendor's general destruction policy if particular payroll, wage, attendance or employment records must be retained for a prescribed period under the applicable law.

4. Essential controls for offsite storage vendors

A. Vendor due diligence

Before appointing a vendor, the organisation should assess the vendor's legal standing, financial stability, security arrangements, operational capacity and record-management practices.

The assessment should cover:

Physical security, including restricted access, CCTV, alarms and visitor logs.

Fire protection, flood protection, pest control and environmental monitoring.

Background verification and confidentiality commitments for personnel handling records.

Disaster recovery, business continuity and recovery-time arrangements.

Information security controls for digitisation, indexing and electronic retrieval.

Subcontractor use and the location of secondary storage facilities.

Insurance coverage, claims procedures and financial capacity to meet contractual liabilities.

References, incident history and independent audit reports, where appropriate.

Due diligence should be proportionate to the sensitivity and importance of the records. Storage of routine administrative documents does not necessarily require the same controls as storage of medical files, whistleblower reports or privileged legal documents.

B. Contractual safeguards

The written agreement should specify the vendor's responsibilities in measurable terms.

Contracts should avoid broad exclusions of liability that leave the organisation without meaningful recourse for loss of critical records.

C. Chain of custody

Chain of custody records the handling of documents from collection through storage, retrieval, transfer and final destruction.

A robust process should record:

Unique box, file or digital-object identifiers.

A manifest of records transferred.

Dispatch and receipt timestamps.

Names or authenticated identities of personnel handling the transfer.

Transport details and receipt acknowledgements.

Access and retrieval logs.

Any damage, seal discrepancies or missing records.

Return, transfer or destruction authorisation.

For high-risk records, tamper-evident seals, barcodes, controlled handovers and independently verifiable audit logs can strengthen evidentiary reliability.

D. Access control

Vendors should be given access only to the records and operations necessary to perform the contracted service.

Recommended measures include role-based access, individual user accounts, periodic access reviews, prompt removal of departed staff, visitor logging and additional approval for sensitive files.

Where documents are digitised, organisations should consider encryption in transit and at rest, controlled download permissions, secure authentication and logging of access or exports.

E. Retention, legal holds and destruction

The employer should approve the retention schedule instead of allowing the vendor to determine retention periods independently.

When litigation, a regulatory investigation, an internal inquiry or another preservation duty arises, relevant records must be placed on hold. Routine destruction must not continue for records covered by the hold.

At the end of the retention period, destruction should be authorised, documented and proportionate to the record type. Physical shredding, secure media sanitisation and verified deletion may be appropriate depending on the format.

5. Six important Indian judicial decisions

The following authorities concern privacy, contractual obligations, confidentiality and electronic evidence. They provide legal principles relevant to offsite storage arrangements, although they are not all direct rulings on storage-vendor contracts.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Court: Supreme Court of India, nine-judge bench.

Facts and issue: The Court considered whether the right to privacy is protected as a fundamental right under the Constitution.

Decision: The Court unanimously recognised privacy as a constitutionally protected fundamental right, connected with dignity, autonomy and liberty.

Relevance to offsite storage: Employee records may reveal personal, financial, medical and professional information. The privacy principle supports proportionate collection, restricted access and protection against unjustified disclosure.

Practical implication: Employers should classify records by sensitivity, limit access to authorised personnel and ensure that vendor arrangements do not permit unnecessary use or disclosure.

The judgment does not itself prescribe a particular storage-vendor audit frequency or technical security standard.

Case 2: Central Inland Water Transport Corporation Ltd. v. Brojo Nath Ganguly (1986)

Court: Supreme Court of India.

Facts and issue: The case concerned the enforceability of an oppressive contractual term in an employment context and the circumstances in which unequal bargaining power may make a contract term unconscionable.

Decision: The Court addressed the enforceability of unfair contractual provisions in circumstances involving unequal bargaining power.

Relevance to offsite storage: Although this was not a storage-vendor case, it illustrates why contractual terms should be examined for fairness and enforceability rather than accepted automatically because they appear in a standard-form agreement.

Practical implication: An organisation negotiating a storage contract should clearly allocate responsibility for loss, negligent handling, confidentiality breaches, subcontracting and records recovery. A vendor should not assume that every liability exclusion will necessarily be enforceable.

Case 3: Oil and Natural Gas Corporation Ltd. v. Saw Pipes Ltd. (2003)

Court: Supreme Court of India.

Facts and issue: The dispute concerned contractual performance, delay and the enforceability of stipulated damages under an arbitration award.

Decision: The Supreme Court examined the application of Section 74 of the Indian Contract Act to stipulated compensation and the conditions under which a contractual sum may be awarded.

Relevance to offsite storage: Storage agreements frequently contain service-level commitments, delivery deadlines, compensation clauses and liquidated-damages provisions.

Practical implication: Organisations should define measurable service failures, such as missed retrieval deadlines, loss of boxes or failure to meet agreed recovery times. Compensation clauses should be drafted with reference to applicable law and the actual contractual risks.

The judgment does not mean that every pre-agreed penalty is automatically recoverable.

Case 4: Anvar P.V. v. P.K. Basheer (2014)

Court: Supreme Court of India.

Facts and issue: The case concerned the admissibility of electronic records and the statutory requirements for proving them under the former Indian Evidence Act.

Decision: The Court established important requirements for admitting secondary electronic evidence under the law then applicable, including the certificate requirement under Section 65B in relevant circumstances.

Relevance to offsite storage: Vendors frequently scan paper records, store electronic files and produce archived emails, logs or document images for litigation.

Practical implication: Employers should preserve the original source where necessary, document the digitisation process, maintain integrity controls and ensure that the appropriate evidentiary requirements are addressed when records are produced.

The Bharatiya Sakshya Adhiniyam, 2023 now governs applicable evidentiary questions for proceedings under its framework; the precise requirements must be checked under that legislation.

Case 5: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

Court: Supreme Court of India.

Facts and issue: The case further examined the admissibility of electronic records and the requirements for certificates under Section 65B of the former Indian Evidence Act.

Decision: The Court clarified the certificate requirements applicable to electronic evidence under the former legislation and discussed circumstances in which the necessary certificate could be obtained through the appropriate process.

Relevance to offsite storage: If an external vendor holds electronic employment records, the organisation may need cooperation from the vendor to obtain records in a form suitable for evidentiary use.

Practical implication: Contracts should require timely assistance with record authentication, preservation of relevant metadata, production of access logs and cooperation with legal proceedings.

The case is not authority for a universal requirement that every stored electronic file must be accompanied by the same certificate in every circumstance under current law.

Case 6: Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

Court: Supreme Court of India.

Facts and issue: The dispute concerned whether contractual obligations could arise from commercial communications even though a formal contract had not subsequently been executed.

Decision: The Court examined the parties' communications and concluded that a binding commercial agreement could arise where the essential terms had been accepted, notwithstanding the absence of a later formal document.

Relevance to offsite storage: Storage services may be agreed through proposals, emails, purchase orders, service schedules and vendor onboarding communications.

Practical implication: Organisations should ensure that their acceptance communications do not unintentionally create or alter contractual obligations, particularly concerning retention periods, destruction authorisation, liability limits and service-level commitments.

A well-controlled procurement process should identify the definitive agreement, its hierarchy of documents and the authorised individuals who can approve variations.

6. Additional judicial authorities

Two additional cases may assist where the dispute involves confidential information or the reliability of electronic records.

Case 7: R. Rajagopal v. State of Tamil Nadu (1994)

Court: Supreme Court of India.

Legal principle: The judgment examined privacy, publication of personal information and the limits of interference with an individual's private life.

Application: It provides broader context for protecting sensitive personal information held in employment files. Employers should not permit storage vendors to use, disclose or publicise personal records outside their authorised purpose.

Case 8: Shreya Singhal v. Union of India (2015)

Court: Supreme Court of India.

Legal principle: The Court examined freedom of speech and expression and invalidated Section 66A of the Information Technology Act, while also considering intermediary liability in the context of online content.

Application: The judgment is relevant to the broader legal environment governing digital information and online intermediaries, but it does not establish a general storage-vendor security duty. For vendor compliance, the applicable data-protection legislation, contract terms and sector-specific requirements remain the primary sources.

7. Common compliance failures and their consequences

These failures may lead to contractual claims, regulatory action, evidentiary difficulties, operational disruption or reputational damage, depending on the circumstances and applicable law.

8. Model compliance framework for an HR department

A practical framework can be divided into five stages.

Stage 1 — Classification

Identify record categories, sensitivity, ownership, retention period and applicable legal obligations.

Stage 2 — Vendor approval

Complete due diligence, assess physical and digital safeguards, and obtain approval from the responsible business and compliance teams.

Stage 3 — Contract and transfer

Execute the agreement, approve subcontractors, create an inventory and document the transfer of custody.

Stage 4 — Monitoring

Review audit reports, inspect facilities according to risk, test retrieval procedures and resolve identified deficiencies.

Stage 5 — Exit and closure

Retrieve or migrate records, verify completeness, address legal holds, obtain destruction certificates where appropriate and revoke access.

9. Recommended audit checklist

The vendor has been formally approved.

The contract identifies the permitted storage locations.

An inventory of all transferred records exists.

Access to sensitive records is restricted and logged.

Retention and destruction rules are documented.

Litigation holds override routine destruction.

Retrieval deadlines and escalation procedures are defined.

Security incidents must be reported under defined contractual timelines.

Audit findings are tracked until corrective action is completed.

Exit procedures cover return, migration and secure destruction.

Electronic records can be produced in a reliable, usable format.

Vendor and subcontractor access is reviewed periodically.

10. Conclusion

Offsite storage vendor controls are an essential component of records governance, employment compliance, privacy protection and litigation readiness. Effective controls require more than selecting a reputable storage company: the organisation must maintain oversight of the records, contractual safeguards, access permissions, retention decisions, evidence preservation and final destruction.

The most relevant legal principles emerge from Puttaswamy on privacy, Central Inland Water Transport on contractual fairness, ONGC v. Saw Pipes on contractual remedies, Anvar P.V. and Arjun Panditrao Khotkar on electronic evidence, and Trimex International on contract formation.

Final compliance principle: An organisation should be able to demonstrate, at any time, what records it entrusted to a vendor, who could access them, where they were stored, whether they remained intact, how quickly they could be retrieved and how their eventual disposal was authorised and documented.