Data Handling Clauses Reviewers Look For

A university DPO in Pune opened an MSA that had already been initialled by the IT cell. The data-handling section said the vendor would follow applicable law and industry best practice. Page forty-one granted a right to use Customer Data to improve the Service. Page forty-seven defined Customer Data to exclude telemetry, prompts and model logs. The DPO spent eleven days putting the clauses back. The file should never have reached initialling.

This is the clause list reviewers in ministries, PSUs, campuses and state data centres actually search for when an agent will touch personal data. It is a field template, not a statute. The Digital Personal Data Protection Act, 2023 and the 2025 Rules are being commenced in phases. CERT-In's 28 April 2022 directions already require covered entities to maintain ICT logs for a rolling 180 days and to keep them available in Indian jurisdiction. Those are different instruments. Write both. Do not let a vendor collapse them into 'we are compliant'.

Not legal advice. Get counsel to fit these rows to your fiduciary map and your sector regulator. A payments workload is not a hostel-allotment workload.

Roles before adjectives

Name the Data Fiduciary. For a government department that is usually the department or the body corporate that determines purpose and means. Name the processor. If the vendor's affiliate, cloud, model host, support tool or evaluation vendor will see personal data, they are in the map. Joint fiduciary is a serious claim; do not accept it as a way to blur who answers the Data Principal.

Purpose must be listed by workflow, not by product name. 'Providing the Service' is not a purpose. 'Drafting a first noting on a grievance ticket using fields X and Y' is a purpose. An agent that can call new tools will invent new purposes unless the contract forbids undeclared tools.

Lawful basis belongs in the department's file, not only in the vendor's privacy notice. Section 7 legitimate uses, where they apply to the State, are not a holiday from security, purpose limitation, or processor control.

The clause table reviewers open first

If a row is missing, the review stops. If a row is present but uses 'as necessary', the review should also stop. Necessary is how undeclared processing enters a government network.

Paste as a checklist in the DPA schedule. Each row needs a clause number in the draft you are marking.

Row	Minimum sentence	Reject if
Roles	Department is fiduciary; vendor is processor; no joint-fiduciary surprise	Roles are 'as applicable' or left to a policy URL
Location	Processing, storage, keys, logs, backups, support screens live in named Indian sites, or a written transfer basis exists	'India region' with unnamed admin plane
Training ban	No use of department data, prompts, traces, embeddings or outputs to train, fine-tune or evaluate foundation models, including for other customers	'May use to improve the Service' or telemetry carved out of Customer Data
Subprocessors	Named list, countries, purposes, flow-down, 30-day objection right	'Affiliates and subprocessors as required'
CERT-In logs	ICT logs retained 180 days, copy available in Indian jurisdiction, clocks sane, reportable incidents on the CERT-In clock	Logs only on vendor laptops or only in a foreign SIEM
Erasure	Deletion of production, backups, embeddings, traces, eval copies, support tickets; certificate with hash scope	Deletion of 'production tenant' only

Logs are not optional plumbing

CERT-In's 28 April 2022 directions, issued under section 70B of the IT Act, require covered entities to enable logs of their ICT systems, maintain them securely for a rolling 180 days, and keep them available to CERT-In. FAQs issued in May 2022 discuss copies and jurisdiction. Read the live PDFs on cert-in.org.in. Do not let a vendor tell you that an air-gapped agent is excused from logging. Isolation without logs is how you fail both the direction and the next incident review.

For agents, logs must include tool calls, retrieval sets by data class, approver identity, model hash, and overrides. That is also what a later CAG party will ask for. Put the minimum trail in the same schedule as the DPDP rows so it is not dropped as an 'engineering detail'.

[Erasure](/blog/sovereign-ai-and-the-right-to-erasure) includes the quiet copies

Embeddings of a scholarship file are still derived from personal data. Plan traces repeat identifiers. Support screenshots sit in a foreign ticket tool. Evaluation sets get emailed to a data-science intern. A deletion clause that only kills the production database is a press release.

Write the list. Write the time. Write the certificate. Write that backups age out on a named cycle. Write that a restore for disaster recovery does not silently recreate a deleted principal's vector.

• Production store, object store, search index, vector index.
• Traces, prompts, outputs, reviewer comments.
• Support tickets, session recordings, APM payloads.
• Vendor eval copies and any 'safety' review queue.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

The vendor will not accept a total training ban.

Then they are asking to become a beneficiary of your processing. That is a different deal. Price it, limit it, and take it to the fiduciary. Do not hide it under improve the service. For most government agents the right answer is still a ban.

We are on-prem, so DPDP processor clauses are lighter.

On-prem changes location. It does not erase the processor relationship if the vendor can still see prompts, raise support tunnels, or take media home. Write the roles for the access they actually have.

CERT-In is a CISO problem, not a contract problem.

It is both. If the contract lets logs live only on a vendor tool abroad, the CISO cannot comply. Put the 180-day Indian-jurisdiction sentence in the schedule.

Erasure of embeddings will break the product.

Then the product's index design is wrong for a fiduciary who must honour erasure. Design per-tenant indexes and a delete-by-principal path. If the vendor cannot, they are selling a system you cannot lawfully run on personal data.

A two-week clause review before anyone initials

Do this on the draft, not on the initialled copy. Reviewers who arrive after initials become the villains of the file.

1. Day 1–3: draw the role map from the architecture PDF, not from the recitals. List every affiliate, model host, support tool and eval vendor.
2. Day 4–6: mark the six-row table. Anything 'as necessary' is a redline, not a comment.
3. Day 7–9: demand the training-ban technical control and the log landing zone. Ask for a deletion certificate template.
4. Day 10–12: counsel writes the transfer and legitimate-use sentences that belong to the department. Vendor language does not write those.
5. Day 13–14: freeze the schedule. IT may initial after this, not before.

How this shows up in the file

Put the six-row table in the file with clause numbers. Add one sentence: no production data, including a paid or unpaid pilot, moves until the schedule is signed. Add one sentence: embeddings and traces are in scope for location, training ban and erasure.

If the vendor will not sign the schedule, you do not have a disagreement about wording. You have a disagreement about who the fiduciary is.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to put this in the RFP, not the preamble

A P6 Compliance/DPO who searches “data handling clause AI contract” is usually drafting or scoring a bid. “Data Handling Clauses Reviewers Look For” belongs in eligibility, the evaluation matrix, or a numbered annexure. If it only lives in the covering note, L1 will ignore it.

Reviewers do not hunt adjectives. They hunt roles, location, a training ban, named subprocessors, CERT-In logs for 180 days in India, and an erasure path that includes embeddings. QCBS weights are a choice you must publish before opening. Accuracy is a task plus a dataset, not a slogan. SLAs for agents must name tool-calls, human gates and log export — uptime alone is a hosting metric.

Do not let a vendor write the specification and then bid on it. Record unsolicited proposals. Pay for pilots that touch personal data. Write exit before you write go-live.

1. Move the control from the preamble into a scored or eligibility row.
2. Attach a one-page definition (accuracy, SLA, language, data handling).
3. Require an artefact in the technical bid, not a slide.
4. Extend the bid date if a corrigendum is material.
5. Minute the demo on your data, offline if you claimed air-gap.

Close this loop before the next CAB

Put “Data Handling Clauses Reviewers Look For” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “data handling clause AI contract” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.