Section 8 of Digital Personal Data Protection Act, 2023 - General Obligations of Data Fiduciary

Section 8 of the Digital Personal Data Protection Act, 2023 sets out the principal compliance responsibilities of a Data Fiduciary for processing digital personal data, including responsibility for processors, data accuracy, security safeguards, breach notification, erasure, contact information and grievance redressal.

Commencement status: The Central Government's notification published on 14 November 2025 provides that Section 8 will come into force eighteen months from publication of that notification. Accordingly, as of 24 September 2026, Section 8 has been enacted but its operative commencement date has not yet arrived. The Digital Personal Data Protection Rules, 2025 have also been notified with a phased commencement framework.

Meaning of important terms

Data Fiduciary: Under Section 2(i), a Data Fiduciary is any person who, alone or together with other persons, determines the purpose and means of processing personal data.

Data Principal: Under Section 2(j), the Data Principal is the individual to whom the personal data relates. The definition also covers specified representatives where the individual is a child or a person with disability having a lawful guardian.

Data Processor: Under Section 2(k), a Data Processor is any person who processes personal data on behalf of a Data Fiduciary.

Personal data breach: Section 2(u) covers unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability.

What Section 8 requires

The section makes the Data Fiduciary accountable for processing undertaken by it and for processing undertaken on its behalf. The main duties can be understood as follows:

The Data Fiduciary remains responsible for compliance even where processing is performed by a Data Processor.
A Data Processor may be engaged for processing connected with offering goods or services only under a valid contract.
Personal data used for decisions affecting a Data Principal, or disclosed to another Data Fiduciary, must meet the statutory requirements of completeness, accuracy and consistency.
Appropriate technical and organisational measures and reasonable security safeguards must be implemented.
Personal data breaches must be intimated to the Data Protection Board and affected Data Principals in the prescribed manner.
Personal data must ordinarily be erased after withdrawal of consent or when the specified purpose is no longer being served, unless retention is required by law.
Relevant business contact information must be published and an effective grievance-redressal mechanism must be maintained.

Section 8 - statutory provisions

Section 8(1) - Responsibility for compliance. A Data Fiduciary is responsible for compliance with the Act and rules for processing undertaken by it or on its behalf by a Data Processor, irrespective of an agreement to the contrary or failure of the Data Principal to perform statutory duties.

Section 8(2) - Data Processor contract. A Data Fiduciary may engage or otherwise involve a Data Processor to process personal data on its behalf for an activity related to offering goods or services to Data Principals only under a valid contract.

Section 8(3) - Accuracy and consistency. Where processed personal data is likely to be used to make a decision affecting the Data Principal, or is likely to be disclosed to another Data Fiduciary, the processing Data Fiduciary must ensure its completeness, accuracy and consistency.

Section 8(4) - Technical and organisational measures. Appropriate technical and organisational measures must be implemented to ensure effective observance of the Act and the rules.

Section 8(5) - Security safeguards. Reasonable security safeguards must protect personal data in the Data Fiduciary's possession or control, including processing performed by a Data Processor, so as to prevent a personal data breach.

Section 8(6) - Breach intimation. In the event of a personal data breach, the Data Fiduciary must intimate the Board and each affected Data Principal in the prescribed form and manner.

Section 8(7) - Erasure. Unless retention is necessary for compliance with law, the Data Fiduciary must erase personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and must cause its Data Processor to erase data made available for processing.

Section 8(8) - When the specified purpose is deemed no longer served. For Section 8(7)(a), the purpose may be deemed no longer served when the Data Principal has neither approached the Data Fiduciary for performance of the specified purpose nor exercised rights relating to the processing for the prescribed period. Different periods may be prescribed for different classes and purposes.

Section 8(9) - Contact information. The Data Fiduciary must publish, in the prescribed manner, the business contact information of the Data Protection Officer, where applicable, or another person able to answer questions on its behalf concerning processing.

Section 8(10) - Grievance redressal. An effective mechanism must be established for redressing grievances of Data Principals.

Section 8(11) - Meaning of not approaching the Data Fiduciary. A Data Principal is treated as not having approached the Data Fiduciary during a period in which she has not initiated contact for performance of the specified purpose, whether in person or through electronic or physical communication.

Illustrations on retention under Section 8(7)

The Act illustrates the retention rule with two situations. Where an individual uses an online marketplace to sell a used car and the transaction is completed, the marketplace should no longer retain the personal data for that specified purpose. By contrast, where a bank is legally required to preserve customer-identification records after an account is closed, the statutory retention obligation permits the bank to retain the data for the legally required period.

Digital Personal Data Protection Rules, 2025 and Section 8

The notified Rules add operational detail relevant to Section 8. In particular, they prescribe minimum elements of reasonable security safeguards, breach-intimation requirements, and rules concerning when specified purposes are deemed no longer served for certain classes of Data Fiduciaries. Their commencement is phased, so the applicable commencement provision should be checked before treating a particular operational requirement as presently enforceable.

Reasonable security safeguards

The Rules contemplate safeguards such as appropriate data-security measures, controls over access, visibility and monitoring, measures to maintain continued processing in the event of compromise, and contractual measures where a Data Processor is involved. Organisations should map the exact notified requirements to their systems and processor contracts before the relevant provisions commence.

Personal data breach notification

The Rules provide operational requirements for informing affected Data Principals and the Data Protection Board when a breach occurs, including prescribed information and timelines. A Data Fiduciary should therefore maintain an incident-response process capable of identifying a breach, containing it, preserving relevant records and preparing the required notifications.

Erasure after the specified purpose ends

The Rules prescribe periods for specified classes of Data Fiduciaries and purposes. This works with Section 8(7) and 8(8), subject to any independent legal requirement that requires longer retention.

Practical compliance checklist for Data Fiduciaries

Identify processing activities for which the organisation determines the purpose and means.
Maintain valid contracts with Data Processors and address applicable security responsibilities.
Apply data-quality controls where information is used for decisions or disclosed to another Data Fiduciary.
Implement documented technical and organisational safeguards proportionate to processing risks and the notified Rules.
Maintain a tested personal-data-breach response and notification process.
Define retention and deletion schedules, including legal-retention exceptions.
Publish the required business contact details when the relevant provisions commence.
Maintain an effective process for Data Principal grievances and related records.

This page is a general legal-information resource. For compliance decisions, refer to the text of the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, commencement notifications and subsequent amendments or corrigenda.