🇮🇳 India · DPA Generator
A complete Data Processing Agreement Word document tailored to a named AI vendor + service: 12 main DPA clauses + Schedule 1 Particulars of Processing (Art. 28(3) mandatory schedule) + Schedule 2 Technical and Organisational Measures (12 control domains × measure × implementation × evidence) + Schedule 3 Sub-Processors (pre-populated with typical sub-processors for the named vendor, with explicit verify-against-vendor callout) + Schedule 4 International Transfer Mechanism + Annex A AI-Specific Contract Terms (6 AI clauses covering training-data restrictions, IP ownership, automated decision-making transparency, bias and fairness, AI error liability, model-update notification + exit rights) + Annex B Negotiation Checklist (10 items with vendor positions, your counter-positions, red flags, and fallback positions) + Annex C Qualified Legal Review Notes (consolidated list of inline review-required callouts grouped by counsel competence) + signature blocks.
The output is anchored on the regulations that apply to AI deployments in IN. The top frameworks cited:
Data fiduciaries must obtain valid consent before processing personal data, implement reasonable security safeguards, respond to data principal rights requests including erasure and grievance redressal, and notify the Data Protection Board and affected individuals of data breaches.
Intermediaries hosting AI services must implement reasonable security practices as per CERT-In directions, comply with government orders to remove unlawful content within 36 hours, and publish user agreements disclosing data practices.
Covered organisations operating AI systems must synchronise ICT clocks with NTP servers, maintain logs of all significant activities for 180 days within India, and report cybersecurity incidents — including AI system breaches — to CERT-In within 6 hours.
RBI-regulated entities using AI for credit decisions, fraud detection, or customer interactions must implement model risk management frameworks including independent validation, maintain explainability for adverse decisions, and designate board-level accountability for AI governance.
You describe your organisation, the AI vendor (Processor), the AI service being procured, and the categories of personal data the service will process. The tool maps your jurisdiction + industry + risk appetite into a structured, schedule-based DPA ready to redline with your legal team.
The DPA follows the format working contract lawyers recognise — main clauses for the contractual body, schedules for the GDPR Art. 28(3) particulars (subject matter / duration / nature / purpose / data categories / data subject categories), schedules for the operational details (TOMs, sub-processors, transfer mechanism), and annexes for the AI-specific protections + negotiation positions + consolidated review-required notes. Risk-appetite-driven defaults (security standard, audit notice, breach window, liability cap, model-update notice) are internally consistent across clauses, schedules, and the negotiation checklist. This is an AI-assisted drafting aid intended to accelerate review by qualified data-protection counsel.
$39 · one-time — answer a 6-question intake (including jurisdiction = IN), and download your tailored document immediately.
Generate DPA →Also available framed for your sector → see industry-specific pages