Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter II — Obligations of Data Fiduciary
DPDP Act, 2023 · Chapter II of IX

Chapter II: Obligations of Data Fiduciary

Chapter II is the operative core of the Act: the lawful grounds for processing personal data, what a notice must say, how valid consent works, the “legitimate uses” that need no consent, and the duties that follow every Data Fiduciary — with heavier rules for children's data and for Significant Data Fiduciaries.

Sections 4–10 · 7 sectionsAll 7 sections effective 13 May 2027Reviewed September 2026
Back to the Full DPDP Act GuideChapter III — Rights and Duties of Data Principal
  1. 4Grounds for Processing Personal Data
  2. 5Notice
  3. 6Consent
  4. 7Certain Legitimate Uses
  5. 8General Obligations of Data Fiduciary
  6. 9Processing of Personal Data of Children
  7. 10Additional Obligations of Significant Data Fiduciary

Chapter summary

In plain terms: A Data Fiduciary may process personal data only with the person's consent or for one of the specific “certain legitimate uses” (Sections 4–7). It must give a clear notice (Section 5), keep data accurate and secure, report breaches, erase data when its purpose ends and run a grievance process (Section 8). Children's data needs verifiable parental consent and may not be tracked or targeted (Section 9), and Significant Data Fiduciaries carry extra duties such as an India-based Data Protection Officer and an independent data audit (Section 10).

How the sections fit together

Chapter II is built as a funnel. Section 4 is the gate: personal data may be processed only for a lawful purpose, with the person's consent or under a listed legitimate use. Sections 5 and 6 build the consent route (a notice, then valid consent). Section 7 is the alternative route that needs no consent. Whichever route you take, Section 8 then applies on top.

Sections 9 and 10 add heavier regimes for particular situations. Section 9 covers children's data and any person with a lawful guardian. Section 10 applies only to Data Fiduciaries the Central Government notifies as significant. Most organisations will work through Sections 4 to 8 in full and check Sections 9 and 10 for applicability.

Sections at a glance

Sections 4–10 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 4Grounds for Processing Personal DataEffective 13 May 2027

Section 4 opens Chapter II with the Act's most fundamental rule: you may only process someone's personal data if you have a lawful basis to do so, and the Act recognises exactly two — the person's consent, or one of the specific "certain legitimate uses" listed in Section 7.

Read the full explanation Sec. 5NoticeEffective 13 May 2027

Section 5 requires that consent never be collected blind: every consent request must come with a notice telling the Data Principal what data is being collected, why, how to exercise their rights, and how to complain.

Read the full explanation Sec. 6ConsentEffective 13 May 2027

Section 6 is the Act's longest and most detailed provision on what makes consent actually valid — free, specific, informed, unconditional and unambiguous — how withdrawal works, and how Consent Managers fit into the picture.

Read the full explanation Sec. 7Certain Legitimate UsesEffective 13 May 2027

Section 7 is the Act's second lawful basis for processing — a closed list of nine specific situations where personal data can be processed without collecting fresh consent, from voluntarily provided data to medical emergencies, disasters and employment-related purposes.

Read the full explanation Sec. 8General Obligations of Data FiduciaryEffective 13 May 2027

Section 8 is the operational core of the entire Act for most businesses: accuracy, security safeguards, breach intimation, erasure timelines, published contact information, and grievance redressal, all in one section.

Read the full explanation Sec. 9Processing of Personal Data of ChildrenEffective 13 May 2027

Section 9 sets a strict default for anyone under eighteen: verifiable parental consent before processing, an outright ban on tracking, behavioural monitoring and targeted advertising directed at children, and a path for the Central Government to relax these rules for specific, verifiably safe use cases.

Read the full explanation Sec. 10Additional Obligations of Significant Data FiduciaryEffective 13 May 2027

Section 10 closes out Chapter II with a heavier compliance tier reserved for organisations the government formally designates as Significant Data Fiduciaries — an India-based Data Protection Officer, an independent data auditor, and ongoing impact assessments and audits.

Read the full explanation

Key terms in this chapter

Notice
A statement given before or when asking for consent that lists the personal data and purpose, how the Data Principal can exercise rights, and how to complain to the Board.
Consent
Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, limited to the stated purpose and to the data necessary for it.
Certain legitimate uses
The cases in Section 7 where data can be processed without consent, such as a voluntary provision of data for a stated purpose, legal obligations, medical emergencies, and employment.
Verifiable parental consent
Consent of a parent or lawful guardian, checked in a way the Rules set out, before processing a child's data.
Personal data breach
Unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability.
Significant Data Fiduciary
A Data Fiduciary or class of fiduciaries notified by the Central Government because of the volume and sensitivity of data and the risks involved.
Data Protection Impact Assessment
A periodic process, required of Significant Data Fiduciaries, that assesses the rights of Data Principals and the risks of processing.

Why this chapter matters

This is the chapter most compliance programmes are built around. Notices, consent flows, retention and erasure schedules, breach response, security safeguards and vendor contracts all trace back to Sections 4–10, and the highest penalties in the Schedule attach to failures here. It also takes effect on 13 May 2027, so it sets the working deadline for most organisations.

Who needs to care about this chapter

  • Every organisation that decides why and how personal data is processed — the Act's definition of a Data Fiduciary — whatever its size or sector.
  • Product, marketing and engineering teams designing sign-up flows, notices and consent screens.
  • Teams handling children's data: education, edtech, gaming, healthcare and family-oriented consumer apps.
  • Large platforms and high-volume processors that could be notified as Significant Data Fiduciaries.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • List every purpose for which you process personal data and record the ground (consent or a Section 7 use) for each.
  • Rewrite notices so each purpose is itemised, with how to exercise rights and how to complain to the Board.
  • Build consent capture that is separate per purpose, needs a clear action, and can be withdrawn as easily as it was given.
  • Plan to give notice for consents collected before the Act, as soon as reasonably practicable.
  • Set retention periods and an erasure process for when the purpose ends or consent is withdrawn.
  • Put in reasonable security safeguards such as encryption, masking, access control, logging and backups.
  • Write a breach-response plan that covers notifying the Board and each affected Data Principal.
  • Sign written contracts with every Data Processor and publish a contact for queries and a grievance process.
  • Add age checks and a parental-consent flow if you may process children's data.
  • Assess whether you could be notified as a Significant Data Fiduciary and what that would require.

Common mistakes to avoid

  • Bundling several purposes into one consent request or pre-ticking boxes.
  • Treating “legitimate uses” as a general legitimate-interest ground. It is a closed list.
  • Leaving old consents untouched when the notice requirements apply to them too.
  • Assuming a vendor contract moves responsibility. The Data Fiduciary stays responsible for processing done on its behalf.
  • Overlooking that employment-related processing can fall under a legitimate use, and building consent flows nobody needs.
  • Tracking or targeting advertising at users who might be children, without an age-assurance step.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 3 — Notice to Data Principal

Read the Rule

Rule 4 — Consent Manager Registration

Read the Rule

Rule 5 — Processing by the State

Read the Rule

Rule 6 — Reasonable Security Safeguards

Read the Rule

Rule 7 — Intimation of Personal Data Breach

Read the Rule

Rule 8 — Retention and Erasure

Read the Rule

Rule 9 — Contact Information for Queries

Read the Rule

Rule 10 — Verifiable Consent for Children's Data

Read the Rule

Rule 11 — Verifiable Consent for Persons with Disability

Read the Rule

Rule 12 — Exemptions for Children's Data

Read the Rule

Rule 13 — Significant Data Fiduciary Obligations

Read the Rule

Common questions

Is consent the only lawful basis under the DPDP Act?
No. The Act recognises two grounds: the Data Principal's consent, or one of the “certain legitimate uses” listed in Section 7, such as responding to a medical emergency or complying with a legal obligation. There is no general “legitimate interest” ground as in the GDPR.
What extra duties apply to children's data?
Section 9 requires verifiable consent of a parent or lawful guardian before processing a child's data, and prohibits processing that is likely to harm a child as well as tracking, behavioural monitoring and targeted advertising directed at children. The Rules provide for exemptions in specified cases.
Who is a Significant Data Fiduciary?
A Data Fiduciary or class of Data Fiduciaries notified by the Central Government, based on factors such as the volume and sensitivity of data, risk to Data Principals' rights, risk to electoral democracy, security of the State and public order. Section 10 then adds duties including a Data Protection Officer based in India, an independent data auditor and periodic impact assessments.
When do these obligations start?
Chapter II is scheduled to take effect on 13 May 2027, following the phased commencement set out under the DPDP Rules, 2025.
Can a Data Principal withdraw consent?
Yes. Section 6 says withdrawal must be as easy as giving consent. The consequences of withdrawal are borne by the Data Principal, and the fiduciary and its processors must stop processing unless another law allows it to continue.
Does a notice have to be in a particular language?
The notice must be available in English or any language listed in the Eighth Schedule to the Constitution, at the Data Principal's option. Rule 3 sets out what the notice must contain.
Who is responsible if a Data Processor causes a breach?
The Data Fiduciary. Section 8 makes it responsible for compliance in respect of processing undertaken on its behalf, whatever the contract between the two says.
What do I have to do after a personal data breach?
Intimate the Board and each affected Data Principal. Rule 7 sets out what the intimation must contain and the time within which it must be made.
Can we process personal data just because our privacy policy says we might?
No. A privacy policy documents what you do; it isn't itself a lawful basis. You still need either the Data Principal's valid consent under Section 6, or one of Section 7's certain legitimate uses.
Is there a "legitimate interest" basis like under the GDPR?
No. The DPDP Act's two lawful bases are consent and the specific, closed list of certain legitimate uses in Section 7 - there's no open-ended legitimate-interest test to balance against.
Is a privacy policy the same thing as the notice required by Section 5?
Not necessarily. A privacy policy can satisfy the notice requirement if it's presented with or before the consent request and contains all three required elements, but a policy that's merely linked somewhere else on a website, disconnected from the actual consent action, is unlikely to meet the standard.
Do we need to renotify every user who already consented before the Act's obligations took effect?
Yes, but not by re-collecting consent - Section 5(2) requires sending them the required notice as soon as reasonably practicable, while allowing processing to continue on the original consent unless they withdraw it.
Can we get a single consent that covers multiple, unrelated purposes at once?
Generally no. Sub-section (1) requires consent to be specific and limited to what's necessary for the specified purpose - the Act's own telemedicine illustration shows that bundling an unnecessary permission into one consent action doesn't validly extend consent to that extra purpose.
If a user withdraws consent, do we have to delete everything we already collected?
Not immediately or automatically under Section 6 itself - withdrawal doesn't undo the legality of past processing, and future retention is governed separately by the erasure obligations in Sections 8(7) and 12(3). But you generally must stop further processing based on that consent within a reasonable time, per sub-section (6).
Is "certain legitimate uses" the same as "legitimate interest" under other data protection laws?
No. It's a closed, specific list of nine situations, not an open-ended balancing test an organisation applies to any processing it considers beneficial.
Can we rely on clause (a) for any data a customer happens to give us?
Only for the specified purpose they gave it for, and only as long as they haven't indicated they don't consent to that use - it isn't a basis for repurposing voluntarily shared data for something unrelated.
If our Data Processor causes a breach, are we still liable?
Yes. Sub-section (1) makes the Data Fiduciary responsible for compliance regardless of what a Processor does on its behalf, which is why the Act requires a valid contract governing that relationship under sub-section (2).
Does every personal data breach have to be reported, no matter how minor?
The Act's text in sub-section (6) doesn't carve out a minimum-severity exception itself; the exact form, manner, and any thresholds are left to the DPDP Rules to prescribe, so check the applicable Rule rather than assuming small incidents are automatically excluded.
Can a child consent to processing themselves once they're old enough to use an app independently?
Under sub-section (1), consent must come from a parent or lawful guardian for anyone who is a "child" under the Act's definition - under eighteen - there's no self-consent pathway for minors in this section.
Is it enough to just ask users to confirm they're over 18 at signup?
Sub-section (1) requires verifiable consent from a parent or guardian when the user is in fact a child; a simple self-declared age checkbox, without more, is unlikely to meet a verifiability standard, though the precise verification mechanics are left to the Rules.
How do we know if our organisation will be designated a Significant Data Fiduciary?
The Central Government notifies specific Data Fiduciaries or classes of them under sub-section (1); it isn't something an organisation opts into or self-assesses definitively, though the listed factors (data volume/sensitivity, risk to rights, and the national-interest factors) give a reasonable basis for anticipating likely designation.
Can our existing Chief Privacy Officer, based outside India, serve as the Data Protection Officer under this section?
No - sub-section (2)(a)(ii) specifically requires the Data Protection Officer to be based in India.

Related pages

Chapter III — Rights and Duties of Data Principal

The next chapter of the Act.

Read Chapter III

Chapter I — Preliminary

The previous chapter of the Act.

Read Chapter I

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

Data Fiduciary

What it means to be a Data Fiduciary and who qualifies.

Read the explainer

Consent under the DPDP Act

How valid consent works in practice.

Read about consent

DPDP Compliance Checklist

Turn Chapter II into an action list.

Open the checklist