SCENARIO S03 · PROCESSORS & EVIDENCE
A vendor contract does not match the actual sub-processor chain. What is the defensible next step?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Confirm the valid contract requirement, then reconcile the real chain as an implementation control.
Label the legal minimum and the implementation mechanism separately. Reconcile them so reviewers can see who actually processes the data.
WHY THE OTHER INSTINCTS MISS
Confirm the valid contract requirement, then reconcile the real chain as an implementation control.
Correct. Act section 8(2) expressly requires a valid contract; a complete sub-processor inventory is useful evidence, not an express statutory list requirement.
Claim the Act expressly requires every sub-processor name in the contract.
That overstates section 8(2). Contract scope and the operational inventory should not be conflated.
Ignore the real chain if the main vendor signed a security addendum.
A document that does not match operations is weak evidence of processor oversight and safeguards.
BUILD THIS EVIDENCE
Valid processor contract, current processing-chain map and reconciliation record.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 8(1)–(2); G.S.R. 843(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)