Section 8, DPDP Act [S10-N5P]
As at 7 September 2026. Not commenced. Commencement appointed for 13 May 2027 by Notification G.S.R. 843(E): phased commencement of the Digital Personal Data Protection Act, 2023 [N11-6ZG].
8. General obligations of Data Fiduciary.—(1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor.
[...]
(4) A Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.
(5) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.
[...]
(7) A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,—
(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier [...]
[...]
Defined terms in this text (5)
data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means
data: 5 more definitions.
Data Fiduciary: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
Data Fiduciary: 3 more definitions.
Data Principal: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "Data Principal" means the individual to whom the personal data relates and, where such individual is a child, includes the parents or lawful guardian, and where a person with disability, includes her lawful guardian acting on her behalf [...]
Data Processor: Section 2(k), DPDP Act: "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary;
personal data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "personal data" means any data about an individual who is identifiable by or in relation to such data
personal data: 3 more definitions.
Made under this section, or naming it (0)
none
Cited by (1)
Section 17, DPDP Act [S10-NA8], 11 August 2023, Band A. "section 8".
Not held (0)
none
Duties published under this section (0)
none