Sharing Data With Vendors Via APIs Under DPDP

When a business shares personal data with a vendor via an API, the DPDP Act treats both parties as accountable for the protection of that data — not just the vendor. The architectural implications are significant. Defense-in-depth is no longer a security best-practice; it is a compliance requirement, with material penalties for organisations that under-invest.

This post is a practical architecture brief on what defense-in-depth API security looks like for DPDP-compliant vendor integrations.

The shared-accountability principle

Under DPDP, a Data Fiduciary (the business making decisions about why and how personal data is processed) remains accountable for that data even when it is shared with a Data Processor (the vendor performing operations on the data on the Fiduciary’s behalf). This is broadly similar to GDPR’s controller / processor framing but with India-specific procedural requirements.

The practical implication: when your vendor has a breach of data you provided, your organisation is not insulated. Regulator scrutiny extends to the contract, the technical controls, the access controls, the monitoring, and the post-incident response. All four matter.

The architectural patterns

We’ve published a full field guide on this topic — including the seven defense-in-depth layers, the contractual provisions that should accompany them, and a 90-day implementation roadmap.

Read the full guide: Sharing Data With Vendors Via APIs Under DPDP

The guide covers:

• The seven security layers (authentication, authorisation, encryption in transit, encryption at rest, rate limiting, monitoring, incident response).
• Contractual provisions that should accompany each layer.
• The minimum-viable monitoring stack for vendor API usage.
• A 90-day rollout plan suitable for organisations starting from a typical mid-market baseline.
• Cost estimates per layer, including ongoing operational cost.

Why this matters now

DPDP enforcement is accelerating in 2026. The regulator has signalled a transition from education-mode to enforcement-mode, and early enforcement actions have focused on vendor-data-sharing failures more than on direct-collection failures. Organisations that have not yet hardened their vendor-API surface are disproportionately exposed.

The remediation cost is meaningful but tractable: typically 8–14 weeks of focused work for a mid-market organisation to land all seven layers, with most of the ongoing cost being monitoring infrastructure rather than incremental engineering.

Read more: /field-guides/sharing-data-with-vendors-via-apis-dpdp · /sectors/financial-services · /sectors/b2b-saas · /markets/india