A data fiduciary engages a THIRD-PARTY DATA PROCESSOR to process personal data on its behalf. Under the Digital Personal Data Protection Act, 2023, the engagement:

Explanation: Section 8(5) of the DPDP Act, 2023 requires a data fiduciary to PROCESS personal data (including engagement of a data processor to process) in accordance with the terms of a VALID CONTRACT, and the fiduciary must take reasonable security safeguards. The responsibility for compliance rests on the data FIDUCIARY: it must ensure the processor operates under a contract and in compliance, and the fiduciary remains liable for the processing unless it shows it complied with its own obligations. The processor process- at the fiduciary's direction and does not become a fiduciary. This contract-plus-liability design makes the engagement accountable.