Your vendors hold your customers’ data too

A small online brand rarely keeps its customers’ data in one place. The order sits on the storefront. The address goes to the courier. The phone number goes to the WhatsApp tool, the email to the newsletter app, the payment to the gateway, and a copy of all of it ends up in a spreadsheet someone shared last Diwali. Count them, and the number is usually higher than anyone expected.

The Act’s word for them

When another company processes personal data on your behalf, the Act calls it a Data Processor. You, the business that decides why and how the data is used, are the Data Fiduciary. The difference matters because of what section 8 says next.

You stay responsible

• Section 8(1): you are responsible for complying with the Act for any processing done on your behalf by a Data Processor, whatever your agreement with them says.
• Section 8(2): you may engage a Data Processor only under a valid contract.
• Section 8(5): your duty to take reasonable security safeguards covers processing done by your Data Processors too. Rule 6(1)(f) asks for those safeguards to be written into the contract.
• Section 8(7)(b): when the data has to be erased, you must make your Data Processors erase it as well.

What this looks like in practice

Most of these contracts already exist: they are the terms you clicked through when you signed up for each tool. The work is finding them, reading what they say about security and deletion, and noting where a tool stores data. Where you have no contract at all, such as a freelancer with access to your order sheet, that is the gap to close first.

Do this week: list every tool and person that can see your customers’ data. Next to each, note whether you have a contract and where it is. One sheet, ten minutes a tool, and you will know where you stand.