Data Processing Agreement (template)

DRAFT. NEEDS LAWYER REVIEW BEFORE USE. This template was written in plain English by the software team, not by a lawyer. It follows the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 as we understand them. Section numbers, dates and duties must be checked by a lawyer, especially because the DPDP Rules come into force in stages. Do not sign it until a lawyer has reviewed it.

Fill in everything in [square brackets].

---

This agreement is between:

1. [Hospital legal name], [address], represented by [name, designation] (the "Hospital"). The Hospital is the Data Fiduciary.
2. Shinel Studios, [legal form, address], represented by [name, designation] ("Shinel"). Shinel is the Data Processor.

Date: [date]

It is part of, and runs alongside, the software licence and the Annual Maintenance Contract (AMC) between the Hospital and Shinel (the "Main Agreement").

---

1. Why this agreement exists

The Hospital uses Shinel's hospital management software (the "Software") to keep patient and billing records. The Software runs on the Hospital's own computers. Shinel does not host or store the Hospital's data.

Shinel can still come into contact with personal data when it gives support: for example during a screen-sharing session, when installing an update, or when checking backups. Under section 8(2) of the DPDP Act, the Hospital may use a Data Processor only under a valid contract. This is that contract.

2. Words used

Words like personal data, Data Principal, Data Fiduciary, Data Processor, processing, personal data breach and Board (the Data Protection Board of India) mean what they mean in the DPDP Act.

Hospital Data means personal data in the Software, or on the Hospital's computers, that Shinel comes into contact with while doing the Services.

Services means the work in section 3.

3. What Shinel does (the Services)

Shinel processes Hospital Data only to:

1. install, set up, update and move the Software;
2. find and fix problems (remote sessions on UltraViewer, visits);
3. check that backups run and can be restored;
4. read support files and error reports the Hospital sends;
5. anything else the Hospital asks for in writing.

4. What data is involved

This includes health data. Shinel treats all of it as sensitive.

How the Software limits what reaches Shinel:

• Automatic alert emails and support files contain no patient data (technical details only; IDs are masked).
• Remote sessions happen only when the Hospital starts them, with a staff member present.

5. Shinel's promises

Shinel will:

1. Follow the Hospital's instructions. Process Hospital Data only for the Services, and only as the Hospital instructs. Not for Shinel's own purposes, not for marketing, not for building other products.
2. Not copy or take data away. Not copy Hospital Data off the Hospital's computers, unless the Hospital asks for it in writing for a specific job (for example recovering a damaged database), and then delete the copy when the job is done and confirm this in writing.
3. Keep it confidential. Make sure everyone at Shinel who may see Hospital Data is bound by a written duty of confidentiality, and is trained on these rules.
4. Keep it secure. Take reasonable security safeguards (section 8(5) of the DPDP Act), including:
   • remote sessions only when started by the Hospital, no unattended or permanent remote access;
   • Shinel's own computers protected with passwords, disk encryption and up-to-date antivirus;
   • support files and emails from the Hospital deleted within [90] days after the issue is closed;
   • the Software's own safeguards: logins and roles, an audit log of money and record changes, uploaded files encrypted at rest, backups kept in a folder only administrators can open.
5. Keep it in India. Not transfer Hospital Data outside India, and not use any service that stores it outside India, without the Hospital's written consent and only where the law allows (section 16 of the DPDP Act).
6. Use no sub-processors without consent. Shinel uses no other company to process Hospital Data. If it ever wants to, it will ask the Hospital in writing first, and bind that company to the same promises. Shinel stays responsible for that company's work.
7. Report breaches fast. Tell the Hospital without delay, and within [24] hours of becoming aware of any personal data breach involving Hospital Data, with: what happened, what data and how many people may be affected, what Shinel has done, and a contact person. Shinel will help the Hospital tell the Board and the affected people (section 8(6) of the DPDP Act and the DPDP Rules).
8. Help with patients' rights. Help the Hospital, at its request, to answer patients who ask to see, correct or erase their data, or who complain (sections 11 to 13 of the DPDP Act). If a patient contacts Shinel directly, Shinel passes the request to the Hospital and does not answer it itself.
9. Keep a record. Keep a simple log of each support session and visit (date, who, what was done) and show it to the Hospital on request.
10. Allow checks. Answer the Hospital's reasonable questions about how it follows this agreement, and allow one review a year on reasonable notice.

6. The Hospital's promises

The Hospital will:

1. collect patient data lawfully: give patients the notice and take the consent the DPDP Act requires, or rely on another lawful ground (for example medical treatment and emergencies);
2. for patients under 18, follow the rules on children's data (section 9 of the DPDP Act);
3. decide how long records are kept, in line with medical record rules;
4. give Shinel only the access needed for each job, and have a staff member present during remote sessions;
5. keep its own computers, Windows, antivirus and backups drives in order;
6. tell Shinel promptly if it learns of a breach that may involve Shinel.

7. When the work ends

When the Main Agreement ends, or when the Hospital asks:

• Shinel deletes any Hospital Data it holds (support files, emails, any copies made under section 5.2) within [30] days, and confirms in writing (section 8(7) of the DPDP Act);
• the Hospital keeps all its data. It stays on the Hospital's computers, and the Software keeps working (see the AMC).

Shinel may keep only what the law requires it to keep (for example invoices), and no patient data.

8. Liability

[To be written with the lawyer: link to the liability clause of the Main Agreement; note that under the DPDP Act the Board can fine the Data Fiduciary for breaches, so the Hospital may want Shinel to cover losses caused by Shinel breaking this agreement, possibly up to an agreed limit.]

9. How long this agreement lasts

From the date above until Shinel has finished all its duties under section 7. Sections 5.3, 5.7 and 7 continue after it ends.

10. Law and courts

This agreement follows the laws of India. Courts at [city] decide any dispute.

If a law or a rule changes the duties of a Data Processor, both parties agree to update this agreement to match.

11. Contacts

---

Signed for the Hospital

Name: ____________________ Designation: ____________________

Signature: ____________________ Date: ____________

Signed for Shinel Studios

Name: ____________________ Designation: ____________________

Signature: ____________________ Date: ____________