Home › Legal › Data Processing Agreement

Data Processing Agreement

Template version 1.0 · Last updated: 25 October 2026 · Governing law: India (DPDPA 2023)

Preamble

This Data Processing Agreement (“DPA”) is entered into on the date of last signature below (“Effective Date”) between:

Digitaliiisla Technologies Private Limited, a company incorporated under the Companies Act, 2013, having CIN U62011RJ2026PTC119030 and registered office at Khemi Sati Road, Jhunjhunu, Rajasthan – 333001, India (“Processor” or “Digitaliiisla”);

and

[Insurer Legal Name], a company / public sector undertaking incorporated under the laws of India, having its registered office at [Insurer Address] (“Controller” or “Insurer”).

Processor and Controller are each a “Party” and together the “Parties”. This DPA supplements the Master Services Agreement between the Parties dated [MSA Date] (the “MSA”) and governs the Processor’s processing of Personal Data on behalf of the Controller. In case of conflict, this DPA prevails on matters of personal-data processing. This DPA is drawn in alignment with the EU Standard Contractual Clauses, Module 2 (Controller to Processor, Decision (EU) 2021/914), adapted for Indian law and the Digital Personal Data Protection Act, 2023.

1. Definitions

• “Personal Data” has the meaning given in section 2(t) of the DPDPA 2023 — any data about an individual who is identifiable by or in relation to such data.
• “Processing” has the meaning given in section 2(x) of the DPDPA 2023.
• “Data Principal”, “Data Fiduciary” and “Data Processor” bear the meanings in the DPDPA 2023. For avoidance of doubt the Controller is the Data Fiduciary and Digitaliiisla the Data Processor for Processing performed under this DPA.
• “Services” means the services provided under the MSA, including the DigiSurvey application, OCR extraction, assessment-sheet preparation, report delivery and allied functionality.
• “Sub-processor” means any third party engaged by Digitaliiisla to process Personal Data in the course of providing the Services.
• “Personal Data Breach” has the meaning given in section 2(u) of the DPDPA 2023.
• “Controller Instructions” means the written instructions issued by the Controller to the Processor under this DPA, including those recorded in the MSA, in the Services configuration, in signed change requests and in formal instruction emails from the Controller’s nominated contact.
• “Applicable Data Protection Law” means the DPDPA 2023, the Information Technology Act 2000 and the rules framed thereunder (including the SPDI Rules 2011 until superseded), the IRDAI Information and Cyber Security Guidelines (as amended), and any other data-protection law applicable to a Party.

2. Subject matter & scope

The Processor will process Personal Data on behalf of the Controller for the sole purpose of providing the Services as described in the MSA. The subject matter, nature and purpose of the Processing, the categories of Data Principals and the categories of Personal Data are set out in Appendix A.

3. Duration

This DPA takes effect on the Effective Date and remains in force for so long as the Processor is processing Personal Data under the MSA. The Processor’s obligations of confidentiality, Clause 7 (Zero Commercial Use), Clause 11 (Breach), Clause 12 (Audit) and Clause 14 (Return / deletion) survive termination for the periods stated.

4. Nature & purpose of Processing

Processor processes Personal Data strictly to:

• Receive, store and index claim documents and photographs uploaded by the Controller or by surveyors authorised by the Controller;
• Run optical character recognition (OCR) and vision inference on uploaded documents and photos to extract fields such as vehicle registration, chassis number, engine number, odometer reading, licence number and policy number;
• Generate the preliminary / final / spot / reinspection survey report in formats agreed with the Controller;
• Deliver the completed report to the Controller through API, portal, email or SFTP channel configured in the MSA;
• Provide support, maintenance, bug-fix investigation and audit co-operation.

Any Processing beyond this scope requires a written Controller Instruction or a signed change order.

5. Categories of Data Principals

Insured persons, claimants, drivers, witnesses, surveyors (including panel surveyors), repairer / dealership staff whose details appear in a claim and the Controller’s employees who use the Services.

6. Categories of Personal Data

• Identity & contact — name, address, email, mobile, aadhaar / PAN masked numbers as they appear on claim forms (Processor does not store full Aadhaar numbers; the last four digits only are retained).
• Vehicle & policy — registration, chassis / engine, policy number, claim number, IDV, premium.
• Financial — invoice amount, bank account last-four, repair estimate, salvage value.
• Biometric via photograph — facial images that may appear incidentally in insured sign-off photos or driving-licence scans. The Processor does not generate face-prints and does not retain these for identity matching.
• Location — GPS co-ordinates embedded in survey photos.
• Communications — call-notes, chat with surveyor, support tickets.

7. Zero Commercial Use pledge

8. Processor obligations

1. Documented instructions. Processor shall process Personal Data only on documented Controller Instructions, including with regard to transfers to a country outside India, unless required to do otherwise by Indian law — in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on grounds of public interest.
2. Confidentiality. Processor shall ensure that persons authorised to process the Personal Data are bound by confidentiality obligations (contractual, under employment or on signed NDA) that survive termination of the engagement.
3. Security measures. Processor shall implement and maintain the technical and organisational measures described in Appendix B and in Digitaliiisla’s Security Statement. Processor shall review these at least annually; first cycle completes October 2027, and strengthen them when reasonably required by the state of the art.
4. Sub-processor engagement. Controller gives general written authorisation to the Sub-processors listed in Appendix A and at /legal/subprocessors.html. Processor shall notify Controller of any intended addition or replacement of a Sub-processor at least 14 days before engagement, by publication on that page and by email to the Controller’s nominated contact. Controller may object on reasonable data-protection grounds within that 14-day window; if the Parties cannot agree, Controller may terminate the Services affected by the proposed Sub-processor without penalty.
5. Sub-processor contracts. Each Sub-processor is bound by a written contract imposing data-protection obligations materially equivalent to those in this DPA, including the Zero Commercial Use obligations in Clause 7.
6. Assistance with Data Principal rights. Taking into account the nature of the Processing, Processor shall assist Controller, by appropriate technical and organisational measures, in fulfilling the Controller’s obligation to respond to Data Principal rights requests (access, correction, erasure, portability, nomination) within the DPDPA timelines. Standard assistance is included in the Services fee; large-volume bespoke exports are chargeable at Processor’s then-current time & materials rate.
7. Assistance with DPIA / consultation. Processor shall assist Controller with any Data Protection Impact Assessment or prior consultation with the Data Protection Board of India to the extent required by Applicable Data Protection Law and relating to the Services.
8. Records. Processor shall maintain a record of all categories of Processing activities carried out on behalf of the Controller, in the form required by Applicable Data Protection Law. The record shall be made available to the Controller on request.

9. Sub-processors (current list)

The list of Sub-processors in use at the Effective Date is set out in Appendix A and is maintained in current form at /legal/subprocessors.html. Each Sub-processor processes Personal Data only to deliver its specific function in the Services and is bound by the obligations summarised in Clause 8.

10. International transfers

Primary data remains stored in India. Where a Sub-processor is located outside India (as disclosed in Appendix A), the transfer is covered by that Sub-processor’s Data Processing Addendum with Processor, which includes contractual safeguards substantially equivalent to the EU Standard Contractual Clauses, and is subject to the restrictions in section 16 of the DPDPA 2023 and any Central Government notification thereunder.

11. Personal Data Breach

1. Notification to Controller: within 24 hours of becoming aware of a confirmed Personal Data Breach affecting the Controller’s data.
2. Content of notification: nature of the breach, categories and approximate number of Data Principals affected, categories and approximate number of records affected, likely consequences, measures taken or proposed, Processor contact for follow-up.
3. Co-operation: Processor shall co-operate with Controller in Controller’s own regulatory notifications (to the Data Protection Board of India, IRDAI, Controller’s customers), and shall not notify any Data Principal or regulator on Controller’s behalf without written instruction.
4. Public reporting: for every High-severity breach, Processor shall publish a post-mortem report on /legal/breach-notification.html within 30 days, redacted of Controller-specific details that Controller requests to be withheld.

12. Audit rights

1. Controller may audit Processor’s compliance with this DPA once per calendar year, with 30 days’ written notice, during Processor’s normal business hours. More frequent audits may be conducted following a Personal Data Breach, a Controller-regulator request or a materially changed risk profile.
2. Processor shall make available all information necessary to demonstrate compliance, including: policies, security controls documentation, SOC 2 / ISO reports of Sub-processors, change logs, pen-test summaries, breach registers and training records.
3. In lieu of an onsite audit, Controller may accept a current third-party attestation covering an in-scope Sub-processor or, once available, DigiSurvey itself; where such attestation does not exist, an onsite audit remains available. Processor’s own certification roadmap: SOC 2 Type I — target Q4 2027; SOC 2 Type II — target Q4 2028; ISO 27001 — target 2028.
4. Each Party bears its own costs of the audit; Controller’s auditor shall sign Processor’s standard NDA and shall not disrupt Processor’s operations or access other customers’ data.

13. Confidentiality

Each Party treats all information disclosed by the other in connection with the Services as confidential. The obligation survives termination for 5 years and indefinitely for Personal Data and trade secrets.

14. Return or deletion

On termination of the Services, Processor shall at the Controller’s choice: (a) return all Personal Data to the Controller in a mutually agreed format (default: JSON records + original media in ZIP, SFTP delivery) within 30 days; or (b) delete all Personal Data within 30 days and certify deletion in writing. Delayed deletion is permitted only to the extent Processor is required by Applicable Data Protection Law or by IRDAI to retain the data, and only for the shortest necessary period, after which the data is deleted on an automated schedule (see /legal/data-retention.html).

15. Liability & indemnity

Subject to the MSA, each Party’s aggregate liability under this DPA is capped at the amount stated in the MSA for data-protection liability. The cap does not apply to: (a) a Party’s wilful breach of this DPA; (b) Processor’s breach of Clause 7 (Zero Commercial Use); or (c) a Party’s indemnification obligations for third-party claims arising from the other Party’s breach of Applicable Data Protection Law. Each Party shall indemnify the other against Data Protection Board penalties and third-party claims to the extent arising from its own breach of this DPA.

16. Governing law & jurisdiction

This DPA is governed by the laws of India. The Parties submit to the exclusive jurisdiction of the courts at Jaipur / Jhunjhunu, Rajasthan, without prejudice to a Data Principal’s statutory right to approach the Data Protection Board of India.

17. Order of precedence

In the event of conflict: this DPA prevails over the MSA on matters of personal-data processing; Appendix A prevails over the body of this DPA for factual descriptions of Processing; the Security Statement prevails over Appendix B for day-to-day control descriptions.

18. Signatures

Appendix A — Processing details & current Sub-processor list

Current Sub-processors: Supabase (India, ap-south-1 — database, storage, auth); Cloudflare (edge — CDN, WAF, Workers); Cloudflare R2 (global object store with APAC + India POP delivery — hot-tier object storage for edge-cached media); AWS S3 Mumbai (India ap-south-1 — encrypted archival storage, tier 2, for IRDAI 7-year audit tail); Google Gemini AI (India/US — OCR & vision inference under Google Enterprise DPA); Resend (EU/US — transactional email under DPA with SCCs); Zoho Campaigns (India — marketing email, opt-in only); Backblaze B2 (dual-region ciphertext — encrypted backup); Razorpay (India — payment gateway, PCI-DSS tokenised). Full details at /legal/subprocessors.html.

Appendix B — Technical & Organisational Measures (summary)

The following is a short summary; the full statement is at /legal/security-statement.html.

• Encryption: AES-256 at rest on Supabase storage & database; TLS 1.3 in transit.
• Access control: MFA mandatory for employee access; RBAC enforced through Supabase Row-Level Security; separate production / staging networks; break-glass access logged and reviewed weekly.
• Infrastructure: Supabase Pro ap-south-1 (Mumbai); Cloudflare WAF & DDoS protection; India data residency for primary data.
• Backup: daily automated backups to Backblaze B2 India (ciphertext); RTO 4 hours, RPO 24 hours.
• Incident response: 24/7 pager, 24-hour internal detection target, 24-hour Controller notification obligation.
• Vulnerability management: quarterly automated scans; annual third-party penetration test (planned Q1 2027 — see Security Statement for current status).
• Employee security: NDA on all contracts; background checks for admin-tier access; annual security training.
• Secure development: code review on every change; dependency scanning; secret-scanning on commits.
• Business continuity: uptime target 99.9%; disaster-recovery runbook rehearsed semi-annually.
• Insurance: cyber liability insurance in force (limits available under NDA).