Vendor Agreement

Every vendor relationship that goes wrong was once a purchase order your accounts team improvised. When an MSME supplier demands Section 16 interest at three times the RBI bank rate — compounded monthly — because your ERP paid 52 days late, or when your cloud vendor quietly moves customer data to a sub-processor you never approved, the contract is the only thing standing between you and a very expensive problem.

A Vendor Agreement built for FY 2026-27 does more than pin down scope and price. It wires in the MSMED Act payment clock from day one, allocates GST and TDS so neither party faces a disallowance under Section 40(a)(ia), attaches a DPDP Act-compliant Data Processing Addendum where personal data is involved, and builds a remedy ladder — SLA credits, liquidated damages under Section 74, then specific performance under the 2018 amendment — so you have real options when delivery goes wrong.

At a Glance

• Who needs this: Any business procuring goods or services from third-party vendors — IT, manufacturing, logistics, staffing, marketing, or professional services.
• Governing law: Indian Contract Act 1872; MSMED Act 2006; CGST Act 2017; IT Act 2000 / DPDP Act 2023; Specific Relief (Amendment) Act 2018.
• MSME payment window: 45 days from acceptance under Section 15, MSMED Act — breach triggers Section 16 interest at 3× RBI bank rate, compounded monthly, with no judicial power to reduce it.
• Tax anchors: TDS under Sections 194C, 194J, 194Q (goods above ₹50 lakh per year from a single vendor), or 195 for non-resident vendors; GST with GSTR-2B reconciliation discipline built in.
• Data exposure: Any vendor handling personal data triggers DPDP Act 2023 obligations — a Data Processing Addendum is mandatory, not optional.
• Turnaround: 5–10 working days for drafting, negotiation support, and execution-ready documentation.

What's New for FY 2026-27

Three statutory changes make vendor agreements drafted before 2024 outdated. Here is what applies from FY 2026-27 onwards.

• Section 43B(h) in full effect: Amounts owed to Micro and Small Enterprise suppliers that remain unpaid beyond the MSMED Act window at financial year-end are disallowed as a business expense in the buyer's hands. Your payment terms must reflect this — the income-tax cost falls on you, not the vendor.
• DPDP Act 2023 enforcement gearing up: The Digital Personal Data Protection Act 2023 enforcement framework is being phased in through 2025-26. Agreements signed now should include a DPDP-aligned Data Processing Addendum with sub-processor lists, 72-hour breach notification timelines, and deletion attestations — retrofitting after a breach is far costlier than drafting it upfront.
• E-invoicing threshold at ₹5 crore: Vendors with annual aggregate turnover above ₹5 crore must generate IRN-linked e-invoices under the GST framework. Your agreement should require the Invoice Reference Number in each payment claim — without it, your Input Tax Credit is at risk under GSTR-2B reconciliation.
• IMS (Invoice Management System) live: GST's Invoice Management System now flags ITC mismatches in near-real time. Contracts should include a clause requiring vendors to rectify GSTR-1 errors within 30 days of a buyer notice — a slow vendor can cost you ITC for the full quarter.
• TCS on LRS for foreign vendor payments: From October 2024, Tax Collected at Source at 20% applies on Liberalised Remittance Scheme outflows above ₹10 lakh. Cross-border vendor agreements need an explicit clause on who absorbs TCS and how the credit flows through.

Why Your Business Needs a Proper Vendor Agreement

• Stops MSME interest liability before it starts: Without a written 45-day payment clause verified against the vendor's Udyam registration, your finance team has no framework — and you typically find out about Section 16 interest in a legal notice, not a reconciliation call.
• Locks in tax treatment on both sides: TDS rates, GST reverse charge applicability, and gross-up obligations look obvious in a pricing sheet but become contested in a disputed invoice. The contract is the reference point for your tax team, the vendor, and any assessing officer.
• Section 43B(h) protection at year-end: An agreement that mandates MSME-status verification at onboarding and requires immediate disclosure of any change is the only way to ensure your accounts payable cycle does not accidentally create an income-tax disallowance at March 31.
• Secures IP in everything the vendor builds: Unless your contract explicitly assigns intellectual property in deliverables to you, Indian copyright law vests ownership in the creator — your vendor. A clean IP assignment clause with moral rights waived is the only way to own what you paid for.
• DPDP Act compliance starts at the contract: If your vendor processes personal data — customer lists, employee records, marketing analytics — you are the Data Fiduciary under the DPDP Act 2023 and accountable for the vendor's processing. A signed DPA is your first line of defence.
• Liquidated damages and specific performance that actually work: Generic 'penalty' clauses are routinely struck down under Section 74. A clause framed as a genuine pre-estimate of loss survives judicial scrutiny and, combined with the Specific Relief (Amendment) Act 2018, gives you both a monetary and a performance remedy.

How It Actually Works

Six stages from initial brief to execution-ready documentation and ongoing compliance.

Step 1: Procurement Brief and Risk Mapping

Your Legal Suvidha advisor captures the full picture before drafting begins: vendor profile, scope of work, deliverables, payment terms, MSME status, volume of personal data involved, and whether the vendor creates any IP for you. This brief takes one to two days and shapes every downstream clause.

The output is a risk map covering MSMED exposure, tax obligations, data-processing triggers, IP creation risk, and the right performance security instrument — bank guarantee, retention, or earnest money deposit.

Step 2: Drafting the Master Vendor Agreement and Supporting Documents

The core agreement is drafted over three to five days. It covers scope, pricing, payment mechanics, MSMED Act obligations, GST and TDS allocation, IP assignment, confidentiality, performance security, SLA definitions and credits, indemnity cap and carve-outs, termination rights, and dispute resolution.

A Statement of Work template, purchase order format, Data Processing Addendum, and bank guarantee text are drafted as a single consistent set — so every SOW you raise later is automatically compliant with the master terms.

Step 3: GST, TDS, and MSMED Configuration

Tax treatment is configured for your specific transaction: applicable TDS section, whether reverse charge applies, e-invoicing obligations where the vendor's turnover exceeds ₹5 crore, GSTR-2B reconciliation cadence, and a cure-right clause if the vendor fails to file returns on time.

The MSMED payment schedule is built into the payment mechanics — not just a recital of the Act — so 45-day compliance is automatic rather than a finance-team workaround.

Step 4: Negotiation Support and Mark-Up Rounds

Your Legal Suvidha advisor supports mark-up rounds with vendor counsel, briefing you on the commercial effect of each proposed change. Concessions that look innocuous in redline — a shorter indemnity cap, a broader IP licence instead of assignment, softened liquidated damages — are flagged before you agree to them.

Step 5: Execution, Performance Security, and Vendor Onboarding

Once terms are agreed, the execution pack is prepared: stamped agreement, SOW, DPA, bank guarantee or earnest money deposit format, vendor MSME declaration, and GST registration verification. Authorised signatory details are confirmed against board resolutions for both parties.

Vendor onboarding documentation — KYC, PAN-GST linkage verification, insurance certificate collection — is completed at the same stage so your accounts payable and compliance teams can operate cleanly from day one.

Step 6: Annual Refresh and Compliance Watch

Vendor agreements go stale. Pricing escalation formulas may need updating, MSME status can change, statutory TDS rates shift, and DPDP Act rules are being notified in phases. An annual review checks all of these, refreshes the SOW and PO templates, and reviews any SLA breaches or liquidated-damages credits from the preceding year.

A Real Example: ₹72 Lakh IT Development Contract

A Bengaluru SaaS company (BuyerCo) engages an MSME software vendor (VendorCo) under a ₹72 lakh annual contract for software development and maintenance, paid monthly in arrears.

• TDS at Section 194C (2%): ₹1.44 lakh deducted per year and deposited by BuyerCo. The agreement includes a gross-up clause so VendorCo's net cash is protected, and a Section 40(a)(ia) cure right if a payment cycle is missed.
• GST at 18%: ₹12.96 lakh per year — VendorCo's turnover exceeds ₹5 crore, so e-invoicing applies. The agreement requires the Invoice Reference Number within 24 hours of invoice generation; a missing IRN means the invoice is not accepted for payment.
• MSMED 45-day clock: Monthly invoice of ₹6 lakh is due 45 days after acceptance. If BuyerCo pays on day 55, Section 16 interest accrues at approximately 19.5% per annum (3 × 6.5% RBI rate) compounded monthly — roughly ₹3,200 on a single delayed payment. If ₹6 lakh remains unpaid at 31 March, BuyerCo also loses the income-tax deduction under Section 43B(h).
• Liquidated damages in practice: VendorCo misses a sprint milestone by three weeks. The agreement provides for 0.5% of SOW value per week of delay, capped at 10% — that is ₹1.08 lakh for the three-week slip, credited against the next invoice with no litigation required.
• IP assignment: All code developed is assigned to BuyerCo on creation. VendorCo retains no licence to reuse the code in competing products — enforceable because the assignment is in the master agreement, not a side email.

This scenario plays out across thousands of Indian vendor relationships every year. The contract is what determines whether these outcomes are predictable or a surprise.

After You Sign: Keeping the Agreement Current

An executed vendor agreement is the starting point, not the finish line. These obligations run for the life of the relationship.

• Annual MSME status check: Verify the vendor's Udyam registration every year. A vendor who loses MSME status mid-contract changes your Section 43B(h) exposure. The agreement should require immediate written disclosure of any change in classification.
• GSTR-2B reconciliation every quarter: Track whether vendor GST filings match your purchase records. A clause requiring the vendor to rectify mismatches within 30 days of a buyer notice protects your ITC for the quarter rather than leaving it to chance.
• Insurance certificate renewal: Commercial general liability, professional indemnity, and cyber liability policies should be renewed annually and certificates submitted to you. Lapsed insurance voids your indemnity coverage at precisely the moment you need it.
• SOW and PO renewals under the master agreement: Each new statement of work should reference and incorporate the master agreement. Standalone purchase orders that contradict master terms create ambiguity — use the SOW template from the outset, every time.
• SLA and liquidated-damages log: Track every SLA breach and credit applied. At contract renewal or in any dispute, a clean log of what was claimed and settled is far more persuasive than reconstructed records.
• DPDP Act rule updates: As the central government notifies rules under the DPDP Act 2023, review the DPA and update sub-processor lists, security standards, and retention schedules. This is an ongoing exercise, not a one-time check.

Section 43B(h) disallowances are assessed at financial year-end, not when payment falls due. A single large MSME invoice unpaid at 31 March can cost you the full income-tax deduction for that amount — the contract structure is your only preventive control.

Where Vendor Agreements Go Wrong

• MSME status not verified at onboarding: You discover the vendor is a registered MSME six months in when they send a legal notice for Section 16 interest. The agreement should require the Udyam registration number upfront and mandate disclosure of any change in status.
• TDS section incorrectly identified: Using 194C (2%) for a professional services vendor who should attract 194J (10%) creates a shortfall that is disallowed under Section 40(a)(ia). The distinction between 'contract work' and 'professional or technical services' must be resolved at drafting, not at assessment.
• 'Penalty' language instead of 'liquidated damages': Courts under Section 74 will reduce or strike out a clause labelled 'penalty'. The same clause, framed as a genuine pre-estimate of loss with a supporting rationale, is typically upheld. The word choice is not a formality.
• IP left to a side letter or email chain: IP assignment documented in an exchange of emails rather than the main agreement or a signed addendum is fragile. If the vendor is acquired or a dispute arises, the assignment chain is challenged first.
• DPA absent or reduced to a confidentiality line: A three-line 'data confidentiality' clause does not satisfy DPDP Act 2023 requirements. Sub-processor control, breach notification timelines, deletion attestation, and security standards are each distinct obligations that need distinct clauses.
• No cure period before liquidated damages trigger: Courts are more willing to enforce liquidated damages where the breaching party had a clear opportunity to remedy and did not take it. A 7–14 day cure period before credits kick in strengthens enforceability considerably.
• Arbitration clause without seat, rules, or arbitrator count: A clause that says 'disputes shall go to arbitration' without specifying seat, governing rules, and number of arbitrators produces years of preliminary litigation just to constitute the tribunal. Specify all three.

What You Receive at the End

• Master Vendor Agreement — execution-ready, stamped
• Statement of Work (SOW) and Purchase Order templates aligned to master terms
• Data Processing Addendum (DPA) covering DPDP Act 2023 obligations
• Bank guarantee or earnest money deposit format and submission checklist
• IP assignment language and moral rights waiver integrated into the agreement
• Vendor onboarding checklist — KYC, GST verification, MSME status, insurance
• GSTR-2B reconciliation and SLA tracking log template
• Plain-English clause summary for your finance and procurement teams

How to Get Started

Share the vendor's profile, intended scope of work, and your preferred payment terms via the Legal Suvidha intake form. If you already have a draft agreement or the vendor's standard terms, upload those as well — a review and redraft takes the same time as a fresh draft, and the starting point changes the negotiation dynamics significantly.

Your Legal Suvidha advisor will schedule a brief call to confirm MSME status, data-processing exposure, IP creation risk, and the right performance security structure. Drafting begins immediately after the call. The execution-ready pack — Master Agreement, SOW template, DPA, and onboarding checklist — is delivered within 5–10 working days, with negotiation support included at no additional charge for the first two mark-up rounds.