DPDP Act Section 8 Explained: General Obligations for Data Fiduciaries

Section 8 of the Digital Personal Data Protection Act 2023 defines the general obligations for a Data Fiduciary. It places strict liability on the entity determining the purpose and means of data processing. A Data Fiduciary must comply with all provisions irrespective of any agreement to the contrary. This obligation holds firm even if a Data Principal fails to carry out their duties under the Act. Organizations cannot contract away their primary accountability. The statute requires the fiduciary to govern data internally and monitor external supply chains. This covers any processing undertaken directly by the fiduciary or on its behalf by a Data Processor. Compliance teams build their privacy frameworks around these exact statutory mandates.

The requirements apply to digital personal data processed within the territory of India. The Act also covers processing outside the country if the activity connects to offering goods or services to Data Principals within India. A foreign software vendor targeting users in Delhi falls under this jurisdiction. Enterprise buyers evaluate Section 8 readiness before they sign new vendor contracts. Banks and large corporations audit whether a software provider can support the client obligations. Procurement cycles stall when a vendor fails to produce an evidence pack proving compliance. The fiduciary holds the regulatory risk. It demands verifiable proof that third parties maintain the required legal and technical standards.

Section 8(2) strictly regulates the relationship between a Data Fiduciary and a Data Processor. A fiduciary may engage or appoint a processor to process personal data on its behalf only under a valid contract. This rule applies to any activity related to offering goods or services to Data Principals. Companies must execute formal agreements for every third party tool touching personal data. A cloud storage provider or a marketing analytics platform qualifies as a processor. The written agreement forms the legal basis for the data transfer. Enterprise fiduciaries pass down their compliance obligations through these documents. The legal team generates the signed contract as an artifact during an external regulatory audit.

Data accuracy forms a specific duty under Section 8(3). The fiduciary is responsible for maintaining complete and consistent records. This requirement triggers automatically under two conditions. The first condition occurs when the data is likely to be used to make a decision that affects the Data Principal. A separate trigger applies when the fiduciary discloses the personal data to another Data Fiduciary. Organizations implement data validation checks at the point of collection to satisfy this rule. Software platforms must design application architectures that prevent unauthorized data modification. A credit scoring algorithm requires verified data inputs to avoid penalizing an applicant unfairly. Technical teams map these accuracy controls directly to the statutory text.

Section 8 compels a Data Fiduciary to erase personal data once the specified purpose is no longer served. The entity must also delete records if the Data Principal withdraws their consent. The fiduciary must cause its Data Processors to erase the data across all interconnected systems. Retaining files indefinitely for hypothetical future uses violates the Act. Fiduciaries use automated retention schedules to delete outdated records predictably. The enterprise compliance officer owns this operational control. They export automated deletion logs from the database layer as definitive proof of compliance. Vendor software systems must support granular deletion capabilities. A platform without a compliant data destruction workflow fails the procurement security review.

Organizations must protect personal data in their possession or under their control. The Act requires fiduciaries to implement reasonable security safeguards to prevent personal data breaches. This duty covers both internal databases and data handled by authorized processors. Fiduciaries execute penetration tests and maintain access logs to document their security posture. The law dictates a strict timeline for incident reporting. The DPDP Rules 2025 mandate that a Data Fiduciary must submit a detailed intimation to the Data Protection Board within 72 hours of discovering a breach. The company must also notify the affected Data Principals without delay. The compliance officer maintains incident response runbooks to prove the organization can meet this exact deadline.

Section 8(7) establishes the framework for handling user complaints. A Data Fiduciary must publish the business contact information of a designated Data Protection Officer or a designated representative. This person is responsible for answering questions regarding data processing. Data Principals hold a legal right to register grievances about their information. The Rules 2025 specify that this contact information must appear clearly on the primary digital platform or application. B2B software companies document their internal workflows for routing these inquiries back to the enterprise fiduciary. The customer support team tracks ticket resolution times. These metrics prove the redressal mechanism operates effectively during a compliance review.

Section 8 obligations interact directly with core operational provisions in the Act. Section 12 gives a Data Principal the right to correction, completion, updating, and erasure of their personal data. Upon receiving a request, the fiduciary must correct inaccurate data or complete incomplete records. These rules operate alongside Section 4, which limits processing to a lawful purpose. A lawful purpose means any purpose not expressly forbidden by law. Processing requires either valid consent or authorization for certain legitimate uses. The fiduciary cannot execute Section 8 compliance without first verifying the legal basis for holding the data. Data governance programs link these sections together through unified software controls.

The Schedule to the Act quantifies the exact financial exposure for compliance failures. A breach of the obligation to take reasonable security safeguards carries a maximum penalty of 250 crore rupees. Failing to report a personal data breach to the Board and affected individuals triggers a separate penalty ceiling of 200 crore rupees. Exactly 218 days remain until the hard compliance deadline of 13 May 2027. Enterprise buyers freeze new software purchases when vendors cannot prove their compliance posture. Software companies must verify whether their current setup generates the evidence pack auditors expect. Schedule a section gap check at https://www.complydp.com/audit-preview to get your platform vendor ready and accelerate stalled procurement cycles.