Section 8: General Obligations of Data Fiduciary
Section 8 is the operational core of the entire Act for most businesses: accuracy, security safeguards, breach intimation, erasure timelines, published contact information, and grievance redressal, all in one section. If an organisation reads only one part of the Act closely, this is usually the one that matters most day to day.
Quick summary
What Section 8 says
- Sub-section (1) — irrespective of any agreement or a Data Principal's failure to carry out her duties, the Data Fiduciary remains responsible for complying with the Act and rules in respect of any processing undertaken by it or on its behalf by a Data Processor.
- Sub-section (2) — a Data Fiduciary may engage, appoint, use or involve a Data Processor for offering goods or services to Data Principals only under a valid contract.
- Sub-section (3) — where personal data processed is likely to be used to make a decision affecting the Data Principal, or disclosed to another Data Fiduciary, the processing Fiduciary must ensure its completeness, accuracy and consistency.
- Sub-section (4) — a Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the Act and rules.
- Sub-section (5) — a Data Fiduciary shall protect personal data in its possession or control, including data processed by a Data Processor on its behalf, by taking reasonable security safeguards to prevent a personal data breach.
- Sub-section (6) — in the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal intimation of the breach, in the prescribed form and manner.
- Sub-section (7) — unless retention is necessary for legal compliance, a Data Fiduciary shall (a) erase personal data upon consent withdrawal or once the specified purpose is no longer being served, whichever is earlier, and (b) cause its Data Processor to erase any data it made available for processing.
- Sub-section (8) — the specified purpose is deemed no longer served if the Data Principal doesn't (a) approach the Fiduciary for its performance, or (b) exercise any of her rights, for a prescribed period, which may differ by class of Fiduciary and purpose.
- Sub-section (9) — a Data Fiduciary shall publish, in the prescribed manner, the business contact information of a Data Protection Officer (where applicable) or another person able to answer questions about the processing.
- Sub-section (10) — a Data Fiduciary shall establish an effective mechanism to redress Data Principals' grievances.
- Sub-section (11) — a Data Principal is deemed not to have approached the Fiduciary for performance during any period in which she has not initiated contact for that purpose, in person or by electronic or physical communication.
Breaking it down
- AccuracySub-s. (3)
- SecuritySub-s. (4)–(5)
- Breach intimationSub-s. (6)
- ErasureSub-s. (7), (8), (11)
- Published contactSub-s. (9)
- Grievance redressalSub-s. (10)
You can't outsource accountability, only the work. Sub-sections (1) and (2) together mean using a Data Processor doesn't transfer legal responsibility — the Fiduciary is on the hook for the Processor's compliance too, which is exactly why a valid contract between them is mandatory, not optional paperwork.
Accuracy matters most where stakes are highest. Sub-section (3)'s obligation is triggered specifically when data will affect a decision about the person, or gets shared onward — a credit decision, an eligibility determination, a background check — rather than applying uniformly to every field in every database.
Breach intimation has no explicit severity threshold in the Act itself. Sub-section (6) doesn't say “only significant breaches” — it requires intimation to the Board and affected individuals for a breach, full stop, with the specific form, manner and any materiality thresholds left to the Rules to prescribe. This is worth planning for conservatively rather than assuming a de minimis exception exists.
Erasure is triggered by two separate events, whichever comes first. Consent withdrawal, or the purpose no longer being served — and sub-section (8) defines that second trigger precisely: a prescribed period of the Data Principal neither approaching the Fiduciary nor exercising any right. The Act's own illustrations: an online marketplace erasing data once a used-car sale concludes, versus a bank retaining KYC records for the ten years banking law requires — the same section, two very different outcomes, because sub-section (7)'s legal-retention exception applies to the bank but not the marketplace.
A published, reachable contact point is a standalone requirement. Sub-section (9) exists independently of whether you're a Significant Data Fiduciary required to formally appoint a Data Protection Officer under Section 10 — every Data Fiduciary needs someone the public can actually reach with questions.
Why this section matters
If the Act had to be reduced to the one section that determines whether an organisation is genuinely operationally compliant — not just has the right consent screens, but actually runs data handling responsibly day to day — it would be Section 8. Security safeguards, breach reporting, erasure discipline, and a working grievance channel are the parts of compliance that show up when something goes wrong, which is exactly when they matter most.
Real-world example
Orbit Logistics, a delivery platform storing customer addresses and payment references
Orbit's data protection lead walks through Section 8 after a minor security incident:
- A misconfigured database briefly exposed a batch of customer addresses to the internet — under sub-section (6), Orbit intimates the Board and the affected customers, rather than treating it as too small to report.
- A customer closed their account eight months ago and hasn't logged in since — under sub-sections (7) and (8), once the prescribed no-activity period passes, the specified purpose is deemed no longer served, and Orbit erases their data — unless a specific record (like a tax-relevant invoice) must be retained under other law.
- A customer emails asking who to contact about a data question — under sub-section (9), Orbit has a published contact already listed in its app and website, satisfying the requirement before the question is even asked.
Who needs to care about this section
- Security and engineering teams — sub-sections (4)–(6) are where technical security posture and incident-response process directly become legal obligations.
- Data governance and retention-policy owners — sub-sections (7), (8) and (11) define exactly when the erasure clock starts and what “no longer served” means.
- Vendor-management and procurement teams — sub-section (2)'s valid-contract requirement needs to be built into every Data Processor engagement, not treated as a standard boilerplate clause.
Common questions
If our Data Processor causes a breach, are we still liable?
Does every personal data breach have to be reported, no matter how minor?
How long can we keep a customer's data after they stop using our service?
Related sections
Section 9 — Processing of Personal Data of Children
Continue to the next section in sequence.
Read Section 9Section 7 — Certain Legitimate Uses
Go back to the previous section.
Read Section 7Chapter II — Obligations of Data Fiduciary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsData Breach
The full operational walkthrough of breach response under the Act and Rules.
Read about data breaches