DPDP reference

Section 8: General obligations of Data Fiduciary

Last checked 6 Nov 2026

The Data Fiduciary answers for all processing by it or on its behalf, whatever a contract says (s.8(1)). A Data Processor may be used only under a valid contract (s.8(2)). Data used for a decision about the Data Principal or passed to another Data Fiduciary must be complete, accurate and consistent (s.8(3)).

It must keep appropriate technical and organisational measures (s.8(4)), take reasonable security safeguards to prevent a personal data breach (s.8(5)), and tell the Board and each affected Data Principal of a breach (s.8(6)).

It erases personal data on withdrawal of consent or once the purpose is no longer served, whichever is earlier, and causes its Data Processor to erase too, unless the law requires retention (s.8(7)). It publishes contact details for a Data Protection Officer or another person who can answer questions (s.8(9)), and sets up an effective way to redress grievances (s.8(10)).

Applies to
Every Data Fiduciary. The duty stays with the Data Fiduciary when a Data Processor does the work (s.8(1)).
Starts
13 May 2027 (G.S.R. 843(E), item (c)).
Penalty
Security safeguards, up to ₹250 crore (s.33, Schedule item 1). Breach notice, up to ₹200 crore (s.33, Schedule item 2). Any other duty here, up to ₹50 crore (s.33, Schedule item 7).
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 8; G.S.R. 843(E), commencement

Questions

Is a business liable for its vendor's processing?

Yes. The Data Fiduciary is responsible for processing undertaken on its behalf by a Data Processor, whatever any agreement says (s.8(1)).

When must personal data be erased?

On withdrawal of consent or as soon as it is reasonable to assume the specified purpose is no longer served, whichever is earlier, unless a law requires retention (s.8(7)).

Related

Next

Join early access

Not legal advice.