Vendor NDA in India: Protecting Pricing and Customer Data

A mid-sized SaaS company onboards an outside agency to run its customer support. The agency gets access to the ticketing system, the customer list, and a rate card that reveals exactly what the company charges each enterprise client. Six months later the agency pitches the same rate card to a competitor as proof of market pricing. The master services agreement has a confidentiality clause of one sentence. It never defined pricing as confidential, never restricted the agency from using the information for other clients, and never required the agency's own staff to be bound.

Vendor relationships are where confidentiality failures are most common in Indian businesses, because the vendor is inside the perimeter. They see the pricing, the customer list, the internal process documents and sometimes the production database. A vendor NDA in India has to do more than say "keep it confidential" — it has to draw boundaries around specific categories of information, control who inside the vendor can see them, and survive the end of the contract. This guide covers the clauses procurement and legal teams should insist on, the India-specific legal points, and the drafting mistakes that leave the buyer exposed.

Why a vendor NDA differs from a customer NDA

A customer-facing NDA usually protects the vendor's information from the customer. A vendor NDA runs the other way: the buyer discloses its information to a supplier who will use it to deliver a service. The information flow is one-directional in principle, but the vendor often discloses its own methodology and tooling, which creates pressure to make the agreement mutual. That pressure should be resisted unless the vendor's disclosures are genuinely sensitive and the buyer actually wants reciprocal obligations.

The structural difference matters because the vendor's staff, subcontractors and cloud providers all touch the information. An NDA that binds only the corporate entity leaves the buyer with a claim against a company whose employees acted outside their authority. The agreement has to reach through the vendor to the people and systems that handle the data.

Vendor relationships also tend to be long. A three-year support contract, renewed automatically, with access that widens over time. The NDA has to anticipate that the scope of information will grow, that personnel will change, and that the exit will involve a migration to a new vendor — all situations where a short template fails.

What a vendor NDA in India should protect

Start by listing the information categories that actually create commercial risk. For most buyers this is narrower than a generic template suggests, but deeper in each category.

• Pricing and margin data. Rate cards, discount matrices, customer-specific pricing, cost structures, supplier quotations. This is the category most often leaked and least often defined. A vendor who knows your pricing can use it in negotiations with your competitors or your customers.
• Customer and prospect data. Names, contact details, contract terms, usage patterns, churn reasons. Where this includes personal data, the DPDP Act, 2023 obligations sit on top of the contractual confidentiality duty.
• Product and technical information. Architecture diagrams, API specifications, source code, test data, roadmaps, unreleased features.
• Commercial strategy. Expansion plans, acquisition targets, fundraising documents, board materials where relevant to the engagement.
• Operational access credentials. System logins, API keys, database access, admin consoles. These are not "information" in the traditional sense but they are the most dangerous thing a vendor holds.

The definition should say that information is covered whether oral, written, electronic or observed during site visits and system access. It should require oral disclosures to be confirmed in writing within a short window. And it should include a catch-all tied to the purpose — "any other information that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure" — so that genuinely sensitive material not listed is still covered without making the definition hopelessly vague.

Clauses procurement teams should insist on

These are the provisions that separate a workable vendor NDA from a signature formality. Each one addresses a failure mode that recurs in real disputes.

Purpose limitation and prohibition on reuse

The vendor may use the buyer's information only to perform the services in the statement of work. This clause does the heavy lifting that a confidentiality definition cannot: it prevents the vendor from mining the buyer's data to build a benchmark, train a model, improve a product, or pitch to another client. Without it, a vendor can argue that using the data internally was never a disclosure and therefore never a breach. Indian courts enforce purpose limitations where they are clear, and the clause should be specific about prohibited uses rather than relying on general language.

Where the vendor provides services to multiple clients in the same industry, the clause should also address Chinese walls — the practical separation of teams so that knowledge gained from one client does not inform work for a competitor. This is difficult to enforce but worth stating, because it gives the buyer a contractual hook if a pattern emerges.

Personnel controls and flow-down obligations

The vendor should name the categories of personnel who will have access, require background verification where the role involves sensitive data, and obligate the vendor to bind each individual to confidentiality terms at least as protective as the NDA. A clause that says "the vendor shall ensure its employees comply" is weaker than one that requires written undertakings and makes the vendor liable for breaches by its personnel.

Subcontractors and affiliates need separate treatment. Many Indian vendors use contract staff or offshore processing partners. The NDA should prohibit disclosure to subcontractors without prior written consent, or permit it only where the subcontractor is bound by equivalent terms and the buyer is notified. Flow-down clauses are standard in outsourcing and should not be omitted because the vendor says it "handles it internally".

Data protection, access and audit rights

Where the vendor processes personal data, the NDA should cross-refer to the DPDP Act, 2023 and to a separate data processing annexure. It should state the purpose of processing, the categories of data, the security measures expected, breach notification timelines, and the position on cross-border transfers. The DPDP Act imposes obligations on the entity determining the purpose of processing; the vendor acts on the buyer's instructions, and the contract should reflect that allocation.

Audit rights are the buyer's assurance that the vendor is doing what it promised. A well-drafted clause gives the buyer, or an independent auditor bound by confidentiality, the right to inspect relevant records and security controls on reasonable notice, at the buyer's cost and no more than once or twice a year absent an incident. Vendors resist open-ended audit rights, and a bounded right is more likely to be accepted and actually used.

Access controls should be operationalised in the NDA: named users only, no shared credentials, multi-factor authentication for administrative access, logging of access to sensitive data sets, and revocation within a defined period of termination or role change. These are not purely contractual points, but writing them into the agreement gives the buyer a remedy if the vendor ignores them.

Term, survival and exit

Confidentiality obligations in vendor contracts should survive termination for a period long enough to cover the commercial value of the information. Three to five years is common for general business information. Pricing data and customer lists often justify longer — five to seven years — because their value persists. Trade secrets such as source code or proprietary algorithms may be protected for as long as they remain secret, with no fixed expiry.

The exit clause is where many vendor NDAs are silent. It should require return or destruction of all information within a defined period, certification of deletion, a transition assistance obligation where the buyer is migrating to another vendor, and retention of archival copies only where law or internal compliance requires it. For personal data, the exit should address deletion from backups within a stated window and the vendor's obligation to confirm it.

Two practical points are often missed. First, the vendor may hold the buyer's data in a software-as-a-service platform where deletion is not instantaneous; the clause should be realistic about backup cycles. Second, the vendor may have generated derivative data — reports, analytics, processed datasets — and the NDA should state who owns those derivatives. A buyer who assumes it owns the analytics output and discovers the vendor is selling aggregated benchmarks to competitors has learned an expensive lesson.

Stamp duty and execution position

A vendor NDA is not compulsorily registrable under the Registration Act, 1908. It creates contractual obligations and does not transfer or declare an interest in immovable property. Registration is optional and rarely done.

Stamp duty is state-specific. The rate depends on the state of execution and on how the instrument is characterised — as an agreement, a service contract, or a deed. Some states levy a fixed nominal amount on agreements generally; others apply a percentage where the agreement has an ascertainable value. Because a vendor NDA is usually signed alongside a master services agreement that carries the commercial value, the NDA itself is often stamped nominally. That is a practice, not a rule that applies everywhere.

Confirm the current rate with the sub-registrar in the state where the document is executed. If the NDA is executed electronically across states, take advice on which state's stamping regime applies. An unstamped agreement is not void, but it can be inadmissible in evidence until the deficit duty and penalty are paid — a problem if the buyer needs an urgent injunction.

Execution should be by someone with authority to bind each entity, with the signatory's name and designation recorded. Where the vendor is a foreign entity, the NDA should state the governing law and the dispute resolution mechanism clearly. Indian law with arbitration seated in India is the usual choice for a vendor operating in India; a foreign governing law creates enforcement complications that are avoidable.

Comparing the clauses across contract types

Vendors are often onboarded under several document structures. The confidentiality obligation may sit in an NDA, a master services agreement, a purchase order or a cloud terms of service. The table below shows where the risk sits in each.

Common mistakes in vendor NDAs

The most damaging mistake is treating the NDA as a one-time onboarding document. Vendor access widens over time — a support vendor gets production access, a marketing agency gets the customer database, a logistics partner gets the order history — and the original NDA never contemplated those categories. The agreement should be reviewed whenever the scope changes, with an amended schedule listing the new information categories.

The second is failing to name pricing. Generic templates cover "business information" but vendors routinely argue that a rate card is not confidential because it was shared with many customers. Naming pricing explicitly, and stating that the compilation and structure of pricing data is confidential even if individual rates are known, closes that argument.

The third is no flow-down. The vendor's employees and subcontractors are the most likely source of a leak, and a clause that binds only the corporate entity leaves the buyer chasing a company that can plausibly deny knowledge.

The fourth is no audit or assurance mechanism. Without a right to check, the buyer has no way to know whether access controls exist until after an incident.

The fifth is silent exit. Vendors that hold customer data often continue to hold backups after termination. The NDA should require certified deletion and, where relevant, transition assistance.

The sixth is ignoring the DPDP Act. A vendor processing personal data under a contract that says nothing about breach notification, retention or cross-border transfer leaves the buyer exposed to regulatory consequences it cannot contract out of.

The seventh is signing the NDA after access has been granted. Onboarding workflows often create system accounts before legal documents are executed. Access should be gated on the signed NDA, not the other way round.

Frequently asked questions

Should a vendor NDA be mutual or one-way?

Usually one-way, with the buyer as discloser. The vendor may ask for reciprocity to protect its methodology and tools. If the vendor's information is genuinely sensitive, a mutual NDA is acceptable, but the obligations should be symmetric in substance and not just in form. A mutual NDA that gives the vendor broader exclusions than the buyer is worse than a one-way document.

Can a vendor NDA prevent the vendor from working for a competitor?

A blanket restriction on serving competitors is a restraint of trade and is likely to be treated as void under Section 27 of the Indian Contract Act, 1872. What the NDA can do is prevent the vendor from using the buyer's confidential information in work for others and require team separation. Exclusivity, if needed, belongs in the commercial agreement and should be limited in scope and duration.

Does a vendor NDA need to be registered?

No. It is not compulsorily registrable under the Registration Act, 1908. Stamp duty may apply depending on the state and characterisation. Confirm the rate with the sub-registrar where the document is executed.

What should happen when a vendor suffers a data breach?

The NDA should require notification to the buyer within a defined period — 24 to 72 hours is common — with details of what was accessed, the likely impact and remediation steps. The buyer should also have the right to notify affected individuals and regulators where required. Under the DPDP Act, 2023, breach notification duties sit with the data fiduciary, so the contractual flow-up from vendor to buyer needs to be fast enough for the buyer to meet its own obligations.

Can the vendor use aggregated data for benchmarking?

Only if the NDA permits it. Many vendors insert a clause allowing use of aggregated, de-identified data to improve services. Buyers should resist or narrow this, because aggregation is difficult to verify and can produce insights that are commercially valuable to a competitor. If it is permitted at all, it should be limited to service improvement, require true anonymisation, and prohibit sale or publication.

Drafting Support

Our drafting team prepares vendor NDAs with schedules that name your actual information categories, flow-down obligations for vendor personnel and subcontractors, and an exit mechanism that covers certified deletion. We can also review an existing master services agreement to identify where the confidentiality provisions fall short of what your vendor access actually requires.