DPDP Act Section 8: What Data Fiduciary Obligations Actually Require

By LegalInk Editorial ·

DPDP Act Section 8: What Data Fiduciary Obligations Actually Require

Section 8 of the Digital Personal Data Protection Act, 2023 imposes the general obligations on every data fiduciary — data accuracy, reasonable security safeguards, personal data breach notification, and erasure of personal data once its purpose is served. These duties operate alongside the notice and consent framework in Sections 5 and 6, which must be satisfied before processing lawfully begins. Section 8 governs what happens once processing is underway, regardless of whether the lawful basis is consent or a legitimate use under Section 7.

How Sections 5, 6, and 8 Fit Together

The Act's architecture links these provisions in sequence, and compliance officers should read them as one chain.

Section 5 requires a data fiduciary to give the data principal a notice — in plain language, and in the data principal's preferred language where possible — specifying what personal data is collected, the purpose of processing, and how the data principal can exercise their rights. This notice must accompany or precede the request for consent.

Section 6 makes valid consent the primary lawful basis for processing personal data not covered by a legitimate use under Section 7. Consent must be free, specific, informed, unconditional, and unambiguous, and a data principal must be able to withdraw it as easily as it was given.

Section 8 then disciplines how data is handled throughout its lifecycle once processing has begun. It is the operational compliance layer that most organisations processing personal data in India will spend the most time on.

The Four Principal Duties Under DPDP Section 8

1. Accuracy and Completeness of Personal Data

A data fiduciary must make reasonable efforts to ensure personal data is accurate and complete — particularly where that data will be used to make a decision affecting the data principal, or will be disclosed to another fiduciary or processor. Where a data principal updates their information, the fiduciary must reflect that update.

In practice, this requires data governance processes that flag stale records and set clear update protocols — especially in banking, insurance, and healthcare, where downstream decisions turn on data accuracy.

2. Security Safeguards

Section 8 requires data fiduciaries to implement reasonable security safeguards to prevent personal data breaches. The section itself does not prescribe a fixed technical standard; the Central Government retains rule-making power to specify safeguards further. The obligation is ongoing — a one-time audit will not discharge it.

For large-scale processing, building these obligations into an existing information security management system (ISO 27001, for instance) is the most practical route. A breach that results from demonstrably absent controls will be directly relevant to any enforcement proceeding.

3. Personal Data Breach Notification

Under Section 8(6), a data fiduciary must notify the Data Protection Board and each affected data principal of a personal data breach. As drafted, this obligation is not limited to breaches above a threshold of harm — notification is required on breach.

The form, timing, and content of such notifications will be set out in rules yet to be notified. In the interim, compliance officers should build incident response playbooks that include a notification workflow, with pre-cleared template communications for both the Board and affected individuals. A breach without a notification process in place compounds both the legal exposure and the reputational risk.

4. Erasure and Retention Limits

Section 8(5) requires a data fiduciary to erase personal data — and cause its processors to erase it — as soon as the collection purpose is no longer served or the data principal withdraws consent, whichever is earlier, unless retention is required under any applicable law.

This interacts directly with the consent withdrawal right in Section 6. When consent is validly withdrawn, the erasure clock starts. Fiduciaries that have shared data downstream must have contractual and operational mechanisms to cascade erasure instructions. A data processing agreement silent on erasure will create gaps at exactly the wrong moment.

Obligations That Flow to Data Processors

A data fiduciary is responsible for ensuring that any data processor it engages processes personal data only on the fiduciary's instructions and in compliance with the Act. The fiduciary remains the accountable party.

Due diligence on processors is therefore not optional. Third-party vendors handling personal data — cloud providers, payroll processors, analytics firms — must be assessed and contractually bound. Compliance cannot stop at the fiduciary's own systems.

Finance-sector organisations, which typically engage multiple processors, should review vendor agreements against these obligations now, before the rules are notified. Our finance compliance framework provides a structured starting point.

Significant Data Fiduciaries: Heightened Obligations

The Central Government may designate certain entities as Significant Data Fiduciaries, and such entities face additional obligations layered on top of Section 8. The designation criteria have not yet been published, but organisations with large user bases or those processing sensitive categories of data should plan for the possibility. Standard Section 8 duties apply to everyone regardless.

Building a Workable Compliance Framework

Section 8 obligations are not a one-time checklist. They require embedded processes: data mapping to know what you hold and why, retention schedules tied to purpose, security controls with regular testing, and a breach response plan that includes notification.

Compliance officers building or reviewing a data protection programme can use the LegalInk compliance framework to map obligations across the Act, and the finance compliance framework for the intersection of DPDP duties with RBI and SEBI data governance expectations.

Several procedural details — notification timelines, prescribed security standards, fee structures for rights requests — remain to be specified in rules. That is not a reason to delay structural work. The core obligations in Sections 5, 6, and 8 are on the face of the statute.

Frequently Asked Questions

Does Section 8 apply to every organisation that processes personal data?

Yes. Every entity that qualifies as a data fiduciary under Section 2 — any person who, alone or with others, determines the purpose and means of processing personal data — is subject to Section 8, regardless of size or sector, unless a specific exemption under Sections 16 or 17 applies.

When must a data fiduciary notify the Data Protection Board of a breach?

Section 8(6) requires notification of every personal data breach. The prescribed form, content, and timelines will be set out in rules yet to be notified. Treat this as an imminent obligation and keep a draft notification workflow ready.

What is the difference between a data fiduciary and a data processor?

A data fiduciary (Section 2) determines the purpose and means of processing. A data processor processes personal data on behalf of and under the instructions of the fiduciary. The fiduciary remains accountable for the processor's compliance.

Once a data principal validly withdraws consent under Section 6, and no other lawful basis (such as a legal obligation to retain) exists, the fiduciary must erase the personal data and instruct any engaged processors to do the same. The Act specifies no grace period.

Organisations building their DPDP programmes can explore legalink.co.in for tools that support compliance drafting and framework development across Indian data protection requirements.

Statute citations in this article are verified against LegalInk's verified law registry before publication. Always confirm the current text of any provision before relying on it.

Related posts

← Back to all posts