A Data Fiduciary's duties are in Chapter II of the DPDP Act, Sec. 4 to 10. In short: have a lawful ground, tell people what you are doing, get valid consent where consent is your ground, keep the data safe, report breaches, erase when you are done, answer questions, and answer complaints. Children's data and Significant Data Fiduciaries carry more.
You are a Data Fiduciary under Sec. 2(i) if you alone or with others determine the purpose and means of processing personal data. This page walks through the duties in the order they depend on each other, because that is the order you have to build them. For the roles in full, see what the DPDP Act is.
First, the lawful ground (Sec. 4 and 7)
Everything starts here. Sec. 4(1) allows a person to process personal data only in accordance with the Act and for a lawful purpose, and only on one of two grounds: the Data Principal's consent, or certain legitimate uses. Sec. 4(2) defines a lawful purpose as any purpose not expressly forbidden by law.
You cannot write a notice or a consent request until you know which ground each purpose rests on. Sec. 7 lists the legitimate uses, clauses (a) to (i), including employment in clause (i). The decision for each purpose of processing, and which ground covers it, is the first deliverable. The applicability guide covers whether the Act reaches you at all.
Then notice and consent (Sec. 5 and 6)
Where consent is the ground, Sec. 5(1) requires every request for consent to be accompanied or preceded by a notice. The notice tells the Data Principal the personal data and the purpose, how she can exercise her rights under Sec. 6(4) and Sec. 13, and how she can complain to the Board. Rule 3 adds what the notice must contain and how it is presented. The notice guide goes through it clause by clause.
Sec. 6(1) then sets the standard for the consent itself: free, specific, informed, unconditional and unambiguous, with a clear affirmative action, limited to the personal data necessary for the specified purpose. Three further duties follow:
- Withdrawal (Sec. 6(4)): she can withdraw at any time, with the ease of doing so comparable to the ease of giving consent.
- Stopping (Sec. 6(6)): on withdrawal, you must within a reasonable time cease processing and cause your Data Processors to cease, unless law requires or authorises it.
- Proof (Sec. 6(10)): where a question arises in a proceeding, you must prove that notice was given and consent obtained.
The proof duty makes the consent record a deliverable, not a by-product. Details are in the consent requirements guide.
Sec. 8: the general obligations
Sec. 8 applies whichever ground you rely on. It has eleven sub-sections, and they fall into three groups.
Responsibility and quality.
- Sec. 8(1): you are responsible for compliance for processing you do or have done on your behalf by a Data Processor, irrespective of any agreement to the contrary.
- Sec. 8(2): a Data Processor may be engaged only under a valid contract.
- Sec. 8(3): where the data is likely to be used to make a decision affecting the Data Principal, or disclosed to another Data Fiduciary, ensure its completeness, accuracy and consistency.
- Sec. 8(4): implement appropriate technical and organisational measures to ensure effective observance of the Act and Rules.
Security and breach.
- Sec. 8(5): protect personal data in your possession or control, including processing by a Data Processor, with reasonable security safeguards. Rule 6 sets minimum measures: encryption, obfuscation, masking or virtual tokens, access control, logs and monitoring, backups, a one-year log and data retention for detection and remediation, and Data Processor contract terms.
- Sec. 8(6): in a personal data breach, give the Board and each affected Data Principal intimation. Rule 7 sets two clocks: affected persons without delay, and the Board without delay, followed by a detailed report within seventy-two hours (or a longer period the Board allows in writing).
Retention and contact.
- Sec. 8(7): erase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, whichever is earlier, unless retention is necessary under law, and make your Data Processor erase it too.
- Sec. 8(8): the purpose is deemed no longer served after the period prescribed with no contact from the Data Principal. Rule 8 and the Third Schedule set it for specified classes, with an erasure warning at least forty-eight hours beforehand. Rule 8(3) also requires a minimum one-year retention of personal data, traffic data and logs of processing, for the purposes in the Seventh Schedule.
- Sec. 8(9): publish the business contact information of a Data Protection Officer, if applicable, or another person who can answer questions. Rule 9 requires it to be prominent on your website or app and in every response to a rights request.
- Sec. 8(10): establish an effective mechanism to redress grievances. Rule 14(3) caps the response period at ninety days.
The security and breach duties carry the largest ceilings in the Act; see DPDP penalties.
Children (Sec. 9)
Before processing the personal data of a child, or a person with disability who has a lawful guardian, you must obtain verifiable consent of the parent or guardian (Sec. 9(1)). Sec. 9(2) prohibits processing likely to cause a detrimental effect on a child's well-being. Sec. 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children.
Sec. 9(4) lets the Rules exempt classes of Data Fiduciary or purposes; Rule 12 and the Fourth Schedule do so. A child is anyone under eighteen under Sec. 2(f).
Significant Data Fiduciaries (Sec. 10)
The Central Government can notify a Data Fiduciary or class as a Significant Data Fiduciary (SDF), looking at the volume and sensitivity of data, risk to Data Principals' rights, effect on India's sovereignty and integrity, electoral democracy, security of the State and public order (Sec. 10(1)). Until you are notified, Sec. 10 does not apply to you.
If you are, Sec. 10(2) adds:
- a Data Protection Officer who represents you, is based in India, answers to the board or similar body, and is the contact for grievance redressal;
- an independent data auditor to evaluate your compliance;
- periodic Data Protection Impact Assessment and periodic audit.
Rule 13 sets the assessment and audit once every twelve months from notification, with the report of significant observations furnished to the Board, a due-diligence duty on algorithmic and technical measures, and the localisation restriction on specified data in Rule 13(4). See cross-border transfers.
Exemptions, and what sits outside Chapter II
Chapter II is not the whole picture. Sec. 17(1) lifts most of Chapter II from certain processing, such as enforcing a legal right or investigating an offence, but never Sec. 8(1) and 8(5): responsibility for Data Processors and reasonable security safeguards stay. The Data Principal's rights in Sec. 11 to 14 are separate duties on top of these, covered in the rights guide.
The duties start on 13 May 2027 (Rule 1(4)). The compliance checklist orders the work and the compliance map ties each provision to a control.