Compliance
Failure to meet these duties can attract scheduled penalties, including fines for inadequate security and for not reporting breaches, making non‑compliance a costly risk for small businesses.
Check your DPDP readiness — free More on the blogSection 8 of the Digital Personal Data Protection Act places the onus on any entity that decides to collect, store or use personal data, termed a Data Fiduciary. Whether the data is processed in‑house or by a third‑party processor, the fiduciary remains fully responsible for complying with the Act’s requirements. This means that delegating work does not delegate liability, and the business must ensure its contracts reflect this responsibility.
The law obliges the fiduciary to make reasonable efforts to keep personal data complete, accurate and consistent, especially when that data influences a decision about the individual or is shared with another fiduciary. In practice, this requires regular data audits, validation checks and updating records promptly when errors are identified, to avoid decisions based on stale or incorrect information.
A fiduciary must put in place reasonable technical and organisational measures to protect data from unauthorised access, loss or disclosure. If a breach occurs, the fiduciary must inform the Data Protection Board and each affected person without undue delay. The schedule of penalties imposes separate fines for lacking adequate safeguards and for failing to notify, making both aspects financially significant.
When an individual withdraws consent or the specific purpose for which the data was collected is no longer being served, the fiduciary must delete the data promptly, unless another law mandates retention. Retaining data merely because it might be useful later breaches the Act and can trigger penalties, so businesses need clear retention schedules linked to legal requirements.
The Act requires the fiduciary to publish the contact details of a Data Protection Officer or another person who can answer queries about data processing. A generic email address without a responsible individual does not satisfy this requirement. The contact point must be reachable and capable of addressing data‑related grievances, otherwise the business risks non‑compliance. Small enterprises often assume the Act does not apply to them, but the obligations arise from the act of processing personal data, not from turnover or employee count. Therefore, any Indian business handling personal data must align its practices with Section 8, or face the schedule‑based fines that the law prescribes.
A Data Fiduciary must ensure data accuracy when it influences decisions or is shared, implement reasonable security safeguards, report any breach to the Board and affected individuals, erase data once consent is withdrawn or the purpose ends (unless law requires retention), and publish a contact who can answer processing queries.
Liability remains with the Data Fiduciary. Even if a vendor processes data on the business’s behalf, the fiduciary must ensure the vendor complies with the Act, as Section 8 makes the fiduciary responsible for all processing activities.
Data must be erased as soon as the individual withdraws consent or when the original purpose for collecting the data is fulfilled, whichever occurs first, unless a separate law requires the data to be retained for a specific period.
Failure to notify the Data Protection Board and affected persons triggers a separate penalty under the schedule of fines. The breach reporting obligation is distinct from the security safeguard requirement, and non‑compliance can lead to substantial monetary penalties.
Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this