Data protection · Provision
Reasonable security safeguards to prevent data breaches, erasure on withdrawal, third-party processor accountability, and published grievance contact. (Section 8, Digital Personal Data Protection Act, 2023.)
Quick Statutory Answer
Under Section 8 of the Digital Personal Data Protection Act 2023 (DPDP Act), a Data Fiduciary is strictly responsible for complying with the Act across all personal data processing, including processing conducted by third-party Data Processors. Mandatory statutory duties include implementing reasonable security safeguards to prevent data breaches (s.8(5)), notifying the Data Protection Board and affected users of any breach (s.8(6)), erasing personal data once purpose ends or consent is withdrawn (s.8(7)), and publishing business contact details of a Data Protection Officer / Grievance Officer (s.8(10)).
| Statutory Obligation | Governing Sub-section | Mandatory Compliance Action | Maximum Penalty (Section 33) |
|---|---|---|---|
| Security Safeguards | Section 8(5) | Implement encryption, access controls, audit logs & firewalls | Up to ₹250 Crore |
| Personal Data Breach Notification | Section 8(6) | Notify Data Protection Board & affected users without delay | Up to ₹200 Crore |
| Data Erasure upon Purpose Completion | Section 8(7) | Automated deletion workflows once consent withdrawn or purpose met | Up to ₹50 Crore |
| Processor Oversight & Contracts | Section 8(1) & (2) | Execute robust Data Processing Agreement (DPA) with vendors | Up to ₹50 Crore |
| Data Accuracy & Consistency | Section 8(3) | Ensure data accuracy before sharing or making decisions | Up to ₹50 Crore |
| Published Grievance Contact / DPO | Section 8(10) | Publish named officer email & address in Privacy Policy | Up to ₹50 Crore |
Penalties up to ₹250 Crore. Failing to take security safeguards carries up to ₹250 Cr; failing to notify a breach carries up to ₹200 Cr under Section 33.
Section 8 requires implementing reasonable security safeguards, notifying breaches to the Board and affected users, erasing data when purpose ends, ensuring data accuracy, and publishing a designated grievance contact.
Yes. Under Section 8(1), the Data Fiduciary remains statutorily responsible for compliance regardless of whether processing is conducted directly or through a third-party Data Processor.
Under the Schedule to Section 33, failure to take reasonable security safeguards to prevent a personal data breach attracts a penalty of up to ₹250 crore.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.