Section 8
Duties of data fiduciaries in India
Most of the Act's obligations fall on the Data Fiduciary. This checklist maps each duty to its section or rule and to the TruePrivacy feature that supports it.
Short answer
A Data Fiduciary is responsible for processing done by it or by a Data Processor on its behalf (s.8(1)). Its core duties are notice (s.5, Rule 3), valid consent (s.6), accuracy (s.8(3)), reasonable security safeguards (s.8(5), Rule 6), breach intimation (s.8(6), Rule 7), erasure (s.8(7)), published contact details (s.8(9), Rule 9) and grievance redressal (s.8(10)). Core obligations begin on 13 May 2027 (Rule 1).
The duty checklist
| Duty | Where it comes from | TruePrivacy support |
|---|---|---|
| Process only with consent or for a legitimate use | s.4, s.6, s.7 | Consent management |
| Give a notice with each consent request | s.5, Rule 3 | Notices |
| Prove notice and consent | s.6(10) | Consent records and receipts |
| Stop processing after withdrawal, and make processors stop | s.6(6) | Consent event log |
| Engage processors only under a valid contract | s.8(2) | Vendors and processors |
| Keep data complete and accurate when used for decisions or disclosed | s.8(3) | Correction requests |
| Technical and organisational measures | s.8(4) | Policies, workflows and audit trail |
| Reasonable security safeguards | s.8(5), Rule 6 | Data security posture |
| Intimate breaches to the Board and each affected Data Principal | s.8(6), Rule 7 | Breach management |
| Erase when consent is withdrawn or the purpose ends | s.8(7), Rule 8 | Retention and erasure |
| Publish the contact of the DPO or responsible person | s.8(9), Rule 9 | Your own notice text |
| Act on access, correction, erasure and nomination | s.11 to s.14, Rule 14 | Data Principal rights |
| Effective grievance redressal | s.8(10), Rule 14(3) | Grievance redressal |
| Verifiable consent for children and guardians | s.9, Rules 10 to 12 | Children's data |
| Extra duties if designated an SDF | s.10, Rule 13 | SDF workspace |
Security safeguards under Rule 6
Section 8(5) requires reasonable security safeguards to prevent a personal data breach. Rule 6 sets the minimum:
- encryption, obfuscation, masking or virtual tokens;
- access control;
- visibility of access through logs, monitoring and review;
- backups and continuity measures;
- keeping logs and personal data for one year, unless another law requires otherwise, to detect and investigate unauthorised access;
- security terms in contracts with Data Processors; and
- technical and organisational measures to enforce these.
Processors remain your responsibility
The fiduciary is responsible for processing done on its behalf by a Data Processor (s.8(1)), and may engage one only under a valid contract (s.8(2)). Rule 6 adds that contracts with processors must include security terms.
When consent is withdrawn, processors must stop processing (s.6(6)). When erasure is due, processors must erase too (s.8(7)). See processor contracts for the clauses to cover.
Contact details and grievances
Every fiduciary publishes on its website or app the business contact of its DPO, if it is a Significant Data Fiduciary, or of a person who can answer questions about processing, and mentions it in every response to a Data Principal (s.8(9), Rule 9).
It must also run effective grievance redressal (s.8(10)), with a published grievance response period of no more than 90 days (Rule 14(3)).
Breach, retention and log duties
On becoming aware of a personal data breach, the fiduciary intimates each affected Data Principal and the Board without delay, and gives the Board a detailed report within 72 hours (Rule 7). The Rule 7 page covers the contents.
Rule 8 sets erasure timelines for the classes in the Third Schedule, with at least 48 hours' notice before erasure. Rule 8(3) keeps personal data, traffic data and logs of processing for at least one year for the Seventh Schedule purposes, and Rule 6 keeps logs for one year to investigate unauthorised access.
Scaling the duties from startup to SDF
- Early-stage teams: start with a data inventory, a Rule 3 notice, consent records, a named contact person and one inbox for requests and grievances.
- Growing companies: add processor contracts, retention and erasure rules, Rule 6 logging and a tested breach runbook.
- Large or high-risk fiduciaries: check whether s.9 applies to your users, and whether you could be notified as a Significant Data Fiduciary under s.10.
How TruePrivacy helps
TruePrivacy brings these duties into one workspace. The DPDP checklist marks each control compliant, partial or non-compliant, with a posture score worked out from live records, and the audit trail logs every action with before and after values, exportable as CSV.
Start where your risk is highest: data discovery to find personal data, then consent, breach management and rights requests.
Is a Data Fiduciary responsible for its vendors?
Yes. It is responsible for processing done on its behalf by a Data Processor (s.8(1)) and may engage one only under a valid contract (s.8(2)).
What security measures does Rule 6 require?
At least encryption, masking or tokens; access control; logs and monitoring; backups; one year of log retention; security terms in processor contracts; and measures to enforce these.
Does every Data Fiduciary need a DPO?
Only a Significant Data Fiduciary must appoint a DPO (s.10(2)(a)). Others publish the contact of a person who can answer questions about processing (s.8(9), Rule 9).
When do these duties start?
Core obligations for Data Fiduciaries begin on 13 May 2027 under Rule 1.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin