Section 8
General obligations of Data Fiduciary
The operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- The Data Fiduciary is responsible for complying with the Act and the rules for any processing it undertakes or that a Data Processor undertakes on its behalf, regardless of any agreement to the contrary and regardless of whether the Data Principal performed her own duties.
- (2)
- A Data Processor may be engaged only under a valid contract.
- (3)
- Where personal data is likely to be used to make a decision affecting the Data Principal, or to be disclosed to another Data Fiduciary, it must be complete, accurate and consistent.
- (4)
- The Data Fiduciary must implement appropriate technical and organisational measures to ensure the Act and rules are effectively observed.
- (5)
- The Data Fiduciary must protect personal data in its possession or control by taking reasonable security safeguards to prevent a personal data breach.
- (6)
- On a personal data breach, the Data Fiduciary must give intimation to the Board and to each affected Data Principal, in the form and manner prescribed.
- (7)
- Unless retention is necessary for legal compliance, the Data Fiduciary must erase personal data on withdrawal of consent or when the specified purpose is no longer served, whichever is earlier, and must cause its Data Processor to erase it.
- (8)
- The specified purpose is deemed no longer served if the Data Principal neither approaches the Data Fiduciary for its performance nor exercises her rights, for the prescribed period.
- (9)
- The Data Fiduciary must publish the business contact information of its Data Protection Officer, where applicable, or of a person able to answer questions about the processing.
- (10)
- The Data Fiduciary must establish an effective grievance redressal mechanism.
In practice
Sub-section (1) is the sentence that survives outsourcing. Liability stays with the fiduciary irrespective of any contrary agreement, so an indemnity from a vendor changes who pays afterwards but never changes who the Board proceeds against. Note also that the sub-sections carry different bands: s.8(5) sits in the Rs 250 crore band and s.8(6) in the Rs 200 crore band, and a single incident can breach both.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 8 is live and carries its own penalty band. When the Board starts issuing orders under it, we will tell you what they actually turned on, cited.