Obligations of Data Fiduciaries
Under the Digital Personal Data Protection Act, 2023, a Data Fiduciary is any entity that determines the purpose and means of processing personal data. With the power to process data comes strict legal accountability. The Act shifts the burden of data protection onto businesses � and failure to comply can result in penalties of up to ?250 crore. This guide covers all 8 core obligations, SDF obligations, a compliance checklist, and real-world consequences.
The 8 Core Obligations at a Glance
1. Providing Clear Notice
Section 5Transparency before data collection.
Before requesting consent, a Data Fiduciary must provide a clear, independent, and easily understandable notice. This notice must explicitly describe the personal data being sought, the specific purpose of processing, and the manner in which the Data Principal can exercise their rights and file complaints.
2. Consent & Legitimate Use
Section 6 & 7Lawful basis for processing.
Personal data can only be processed based on the free, specific, informed, unconditional, and unambiguous consent of the Data Principal. Alternatively, data can be processed for certain "legitimate uses" defined by the Act. Crucially, consent must be as easy to withdraw as it is to give.
3. Data Minimisation & Accuracy
Section 8(1) & 8(2)Collect only what is needed.
Fiduciaries must only collect data that is absolutely necessary for the specified purpose (Data Minimisation). Furthermore, they are obligated to ensure that the personal data processed is accurate, complete, and kept up-to-date, especially when the data is used to make decisions affecting the individual.
4. Storage Limitation
Section 8(7)Delete when the purpose is served.
Data cannot be retained indefinitely. The Data Fiduciary must erase personal data once the purpose for which it was collected is fulfilled, or when the Data Principal withdraws consent, unless retention is required by law for legal or regulatory compliance.
5. Security Safeguards
Section 8(5)Protect the data at all costs.
Organisations are legally required to implement reasonable technical and organizational security safeguards (like encryption, access controls, and monitoring) to prevent data breaches. The responsibility extends to ensuring that third-party Data Processors also maintain these standards.
6. Breach Notification
Section 8(6)Report incidents immediately.
In the event of a personal data breach, the Data Fiduciary must notify the Data Protection Board of India and the affected Data Principals without any undue delay. The notification must detail the nature of the breach, the potential impact, and the remedial actions taken.
7. Grievance Redressal
Section 13A dedicated mechanism for complaints.
Every Data Fiduciary must establish an effective and readily available grievance redressal mechanism. If a Data Principal is not satisfied with the response, they have the right to escalate the complaint to the Data Protection Board of India.
8. Accountability & Appointing DPO
Section 10Governance and oversight.
Significant Data Fiduciaries (SDFs) have enhanced obligations, including appointing a Data Protection Officer (DPO) based in India, appointing an independent data auditor, and conducting periodic Data Protection Impact Assessments (DPIAs).
Detailed Breakdown of Each Obligation
Each obligation is backed by a specific section of the DPDP Act and enforced by the Data Protection Board. Here is what each obligation means in practice, including the specific steps a Data Fiduciary must take:
1. Providing Clear Notice
Section 5Transparency before data collection.
Before requesting consent, a Data Fiduciary must provide a clear, independent, and easily understandable notice. This notice must explicitly describe the personal data being sought, the specific purpose of processing, and the manner in which the Data Principal can exercise their rights and file complaints.
What this means in practice:
- ?Notice must be provided BEFORE consent is sought
- ?Must be in clear, plain language (including regional languages)
- ?Must describe the specific data being collected
- ?Must state the purpose of processing
- ?Must explain how to exercise rights and file complaints
- ?Must include a link to withdraw consent
2. Consent & Legitimate Use
Section 6 & 7Lawful basis for processing.
Personal data can only be processed based on the free, specific, informed, unconditional, and unambiguous consent of the Data Principal. Alternatively, data can be processed for certain "legitimate uses" defined by the Act. Crucially, consent must be as easy to withdraw as it is to give.
What this means in practice:
- ?Consent must be free, specific, informed, unconditional, and unambiguous
- ?Consent must be limited to the specified purpose
- ?Consent withdrawal must be as easy as giving consent
- ?Legitimate uses include: state functions, legal obligations, medical emergencies
- ?Consent Managers may be used to manage consent
3. Data Minimisation & Accuracy
Section 8(1) & 8(2)Collect only what is needed.
Fiduciaries must only collect data that is absolutely necessary for the specified purpose (Data Minimisation). Furthermore, they are obligated to ensure that the personal data processed is accurate, complete, and kept up-to-date, especially when the data is used to make decisions affecting the individual.
What this means in practice:
- ?Collect only data necessary for the specified purpose
- ?Ensure data is accurate, complete, and up-to-date
- ?Implement processes for correction of inaccurate data
- ?Avoid collecting data "just in case" it might be useful
- ?Regularly review and update data quality
4. Storage Limitation
Section 8(7)Delete when the purpose is served.
Data cannot be retained indefinitely. The Data Fiduciary must erase personal data once the purpose for which it was collected is fulfilled, or when the Data Principal withdraws consent, unless retention is required by law for legal or regulatory compliance.
What this means in practice:
- ?Erase data when the purpose is fulfilled
- ?Erase data when consent is withdrawn
- ?Retention allowed where required by law (e.g., tax, RBI KYC)
- ?Implement a data retention schedule
- ?Regularly audit and purge obsolete data
5. Security Safeguards
Section 8(5)Protect the data at all costs.
Organisations are legally required to implement reasonable technical and organizational security safeguards (like encryption, access controls, and monitoring) to prevent data breaches. The responsibility extends to ensuring that third-party Data Processors also maintain these standards.
What this means in practice:
- ?Implement reasonable technical safeguards (encryption, firewalls, access controls)
- ?Implement organisational safeguards (policies, training, audits)
- ?Ensure Data Processors maintain equivalent standards through contracts
- ?Conduct regular security audits and penetration testing
- ?Failure to protect data can attract up to ?250 crore penalty
6. Breach Notification
Section 8(6)Report incidents immediately.
In the event of a personal data breach, the Data Fiduciary must notify the Data Protection Board of India and the affected Data Principals without any undue delay. The notification must detail the nature of the breach, the potential impact, and the remedial actions taken.
What this means in practice:
- ?Notify the Data Protection Board "without undue delay"
- ?Notify affected Data Principals without undue delay
- ?Notification must describe the nature of the breach
- ?Notification must describe the impact and remedial actions
- ?Failure to notify can attract up to ?200 crore penalty
7. Grievance Redressal
Section 13A dedicated mechanism for complaints.
Every Data Fiduciary must establish an effective and readily available grievance redressal mechanism. If a Data Principal is not satisfied with the response, they have the right to escalate the complaint to the Data Protection Board of India.
What this means in practice:
- ?Publish the name and contact details of a Grievance Officer
- ?Establish a clear, accessible complaint process
- ?Respond to complaints within the prescribed time
- ?If unresolved, Data Principals can escalate to the Board
- ?Maintain records of all complaints and resolutions
8. Accountability & Appointing DPO
Section 10Governance and oversight.
Significant Data Fiduciaries (SDFs) have enhanced obligations, including appointing a Data Protection Officer (DPO) based in India, appointing an independent data auditor, and conducting periodic Data Protection Impact Assessments (DPIAs).
What this means in practice:
- ?Applies only to notified Significant Data Fiduciaries (SDFs)
- ?Appoint a DPO based in India
- ?Appoint an independent data auditor
- ?Conduct periodic Data Protection Impact Assessments (DPIAs)
- ?Undertake other measures as prescribed
What is a Significant Data Fiduciary (SDF)?
Not all Data Fiduciaries are equal. The Act creates a special category called Significant Data Fiduciary (SDF) � organisations that process large volumes of sensitive data or pose a higher risk to Data Principals. The Central Government notifies SDFs based on the following factors:
Volume & Sensitivity of Data
The volume and sensitivity of personal data processed by the Fiduciary.
Risk to Data Principals
The risk to the rights of Data Principals.
Impact on Sovereignty
The potential impact on the sovereignty and integrity of India.
Security of the State
The risk to the security of the State.
Electoral Democracy
The risk to public order or electoral democracy.
Enhanced Obligations for SDFs
- Appoint a Data Protection Officer (DPO) based in India, reporting to the board
- Appoint an independent data auditor to evaluate compliance
- Conduct periodic Data Protection Impact Assessments (DPIAs)
- Undertake such other measures as may be prescribed
Failure to comply with SDF obligations can attract a penalty of up to ?150 crore.
16-Point DPDPA Compliance Checklist
To operationalise the 8 obligations, here is a practical 16-point checklist that Data Fiduciaries can use as a starting point:
Consequences of Non-Compliance
Failure to comply with these obligations can trigger significant penalties, imposed by the Data Protection Board. Here is a summary:
| Violation | Max Penalty |
|---|---|
| Failure to take reasonable security safeguards | Up to ?250 Crore |
| Failure to notify a personal data breach | Up to ?200 Crore |
| Processing children's data without consent | Up to ?200 Crore |
| SDF non-compliance | Up to ?150 Crore |
| Failure to comply with Board directions | Up to ?150 Crore |
| General non-compliance (including grievance redressal failures) | Up to ?50 Crore |
For a detailed breakdown, see our full penalties guide.
Practical Tips for Compliance
Start with a data inventory
You cannot protect what you do not know you have. Map all personal data your organisation collects, processes, and shares.
Build consent into your product, not on top of it
Consent should be a first-class feature, not an afterthought. Make it easy to give, easy to withdraw, and easy to audit.
Treat vendors as extensions of your compliance
Every vendor that touches personal data must sign a DPA. Audit them. Hold them to the same standards you hold yourself.
Document everything
The Board will ask: "Did you take reasonable safeguards?" The answer must be documented � policies, audits, training records, incident logs.
Appoint a DPO early
Even if you are not yet an SDF, appointing a DPO sends a strong signal of commitment and prepares you for SDF notification.
Train your team
Obligations are operationalised by employees. Train them on data handling, breach reporting, and grievance redressal.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
What is a Data Fiduciary under the DPDP Act 2023?+
A Data Fiduciary is any person, company, or entity that alone or jointly with others determines the purpose and means of processing personal data. This includes most businesses, websites, apps, and service providers operating in India.
What are the core obligations of a Data Fiduciary?+
The 8 core obligations are: (1) Providing clear notice before collecting data, (2) Obtaining valid consent or establishing legitimate use, (3) Data minimisation and accuracy, (4) Storage limitation, (5) Implementing reasonable security safeguards, (6) Breach notification, (7) Grievance redressal, and (8) Appointing a DPO (for SDFs).
What is a Significant Data Fiduciary (SDF)?+
An SDF is a Data Fiduciary notified by the Central Government based on factors such as the volume and sensitivity of data processed, risk to Data Principals, impact on India's sovereignty, and risk to electoral democracy. SDFs have enhanced obligations, including appointing a DPO in India and conducting DPIAs.
How quickly must a data breach be reported under the DPDP Act?+
The Act requires breach notification "without undue delay." While the exact timeline will be prescribed in the Rules, industry practice suggests notification to the Board within 72 hours and to affected Data Principals without undue delay. Failure to notify can attract a penalty of up to ?200 crore.
What happens if a Data Fiduciary fails to comply with its obligations?+
Failure to comply can attract civil penalties ranging from ?50 crore to ?250 crore, depending on the nature of the violation. The Data Protection Board can also issue directions, order remedial measures, and proceed against directors and officers personally.
Does the DPDP Act apply to small businesses?+
Yes. The DPDP Act applies to all Data Fiduciaries processing personal data in India, regardless of size. However, the government may exempt certain classes of Data Fiduciaries (such as startups) from certain obligations through notification, subject to safeguards.
What is the role of a Data Protection Officer (DPO)?+
A DPO is responsible for ensuring compliance with the DPDP Act, acting as a point of contact for Data Principals and the Data Protection Board, and overseeing data protection impact assessments. For SDFs, the DPO must be based in India and report to the board of directors.
Can a Data Fiduciary outsource its obligations to a Data Processor?+
No. While a Data Fiduciary can engage a Data Processor, the ultimate responsibility for compliance remains with the Data Fiduciary. The Fiduciary must ensure the Processor implements adequate security safeguards through a valid contract and remains liable for the Processor's acts.
Related Topics for Businesses
Penalties for Non-Compliance
Learn about the fines up to ?250 crore.
Data Breach Response
How to report a breach within 72 hours.
Rights of Data Principals
The rights your obligations are designed to protect.
Data Protection Board
The authority that enforces these obligations.
DPDPA Complete Guide
The ultimate guide to the new law.
Cross-Border Data Transfer
Obligations for international data transfers.
Need to train your team?
Understanding these obligations is the first step. Ensure your legal, IT, and HR teams are aware of the new DPDP Act rules. Use our free assessment to see where your organisation stands today.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. For advice on your specific situation, consult a qualified legal professional.