The Digital Personal Data Protection Act has mandated businesses to follow several data protection obligations. The DPDP Act is going to be enforced in May 2027. Businesses must know all the rules and regulations to be compliant before the audit. Failure to comply with the DPDP Act can bring massive penalties, and businesses should take appropriate measures. This guide gives an overview of all the obligations businesses must know to avoid penalties and comply with the DPDP Act.
What are the Key Obligations of the DPDP Act for Data Fiduciaries?
A Data Fiduciary must follow its obligations to show due diligence, ensure accountability, and protect individuals’ privacy rights. These are the obligations it must follow-
Process the Data for lawful Purposes Only (Section 4 and 7)
Section 4 of the Act says that a Data Fiduciary can process personal data only for a lawful purpose. Means the fiduciary must have a valid reason before processing the data. Section 7 explains all the valid use cases where data processing can be done:
Under Section 7, A Data Fiduciary may process personal data for any of the following reasons:
-
Section 7(a) – Voluntarily provided data for a specified purpose
A Data Fiduciary can process the personal data that is shared by the Data Principal willingly only for a clear purpose. It will be processed as long as they haven’t said “no” to that use.
(A Data Principal is the individual whose personal data is being processed by the Data Fiduciary.)
-
Section 7(b) – State subsidies, benefits, services, licences and permits
The State or its agencies can process an individual’s data to give them benefits, certificates or permits.
-
Section 7(c) – National security
The State or its agencies can process data to perform their legal functions to protect India’s sovereignty, integrity and security.
-
Section 7(d) – For fulfilling any obligation under any law
If a law requires sharing information with the government, the data can still be processed.
-
Section 7(e) – Court orders, judgments and decrees
Data can be processed to comply with Indian court or legal orders, and with foreign judgments or orders on contractual or civil claims.
-
Section 7(f) – Medical emergencies
Data can be processed when someone’s life or health is under immediate threat.
-
Section 7(g) – Epidemics and public health threats
Data can be processed to provide treatment or health services during an outbreak of disease or other public health threat.
-
Section 7(h) – Disasters and breakdown of public order
Data can be processed to keep people safe or help them during a disaster (as defined in the Disaster Management Act, 2005). Data can also be processed when public order breaks down.
-
Section 7(i) – Employment purposes
An employer can process employee data for employment needs or providing services and benefits the employee asked for.
Businesses that act as a Data Fiduciary need a clear ground before processing any data. If they do not have one, they must not process the data.
Give a Clear Notice (Section 5 and Rule 3)
A notice must be given before or with every consent request given to the individual. The Data Fiduciary’s notice must tell individuals three things:
- What personal data is being collected, and why it is needed
- How they can use their rights
- How they can file a complaint with the Data Protection Board
Now according to Rule 3 of DPDP Rules, 2025, adds further requirements. The notice must be clear, understandable, and presented separately from other information. It must describe the personal data and the specific purposes for which it will be processed.
The notice must also provide information about the means through which individuals can withdraw consent, exercise their rights, and make a complaint, as applicable under the Rules.
The notice must be available in clear and plain language, in English or an applicable language listed in the Eighth Schedule to the Constitution of India.
Take and Manage Valid Consent (Section 6)
The individual’s consent must be taken freely, for a clear purpose, with full understanding, without conditions. It must be given through an obvious action. The data then collected must be for the stated purpose only.
Individuals can withdraw their consent at any time and the withdrawal process must be as simple as the consent giving process.
At the time of dispute, the whole burden will fall on the shoulders of Data Fiduciaries. To ease the process, they need to prove that notice was given and consent was given by the individual.
To meet this obligation, businesses should maintain appropriate records of:
- The notice presented to the individual.
- The consent obtained and the purpose covered.
- The date and method of consent.
- Any subsequent withdrawal of consent and the action taken.
Remain Accountable on behalf of Data Processors [Section 8(1) and 8(2)]
Data Fiduciaries sometimes hire Data Processors on contractual basis to handle specialized technical or operational data duties. However, hiring a Data Processor doesn’t remove responsibilities for the Data Fiduciary.
- Section 8(1) keeps the Fiduciary responsible for all the data processing done on their behalf by the Processors, even if the have contract.
- Section 8(2) adds the obligation that the Fiduciary can engage with a processor only under a valid contract.
A well-drafted contract should cover:
- Security safeguards and breach reporting.
- Permitted purposes and handling of personal data.
- Assistance with Data Principal requests.
- Sub-processor arrangements, where relevant.
- Retention, return, and deletion of personal data.
- Incident management and cooperation during investigations.
A Data Fiduciary cannot rely only on the contract while hiring the Processors, they need to check what data the processor receives, where it goes, and how it handles incidents and deletion requests.
Regular checks help the Data Fiduciary prove that it is actually following its contractual requirements.
Maintain Complete, Accurate and Consistent Personal Data [Section 8(3)]
Section 8(3) requires a Data Fiduciary to ensure that personal data is complete, accurate, and consistent. Because incorrect or incomplete information can lead to unfair or inappropriate decisions.
For example, an incorrect customer address could result in a failed delivery.
Businesses should establish procedures for checking important records, correcting errors, updating information, and verifying data before using it to make decisions or sharing it with another Data Fiduciary.
Implement Appropriate Technical and Organisational Measures [Section 8(4)]
Section 8(4) requires Data Fiduciaries to implement appropriate technical and organisational measures to ensure effective observance of the DPDP Act. These measures should translate legal requirements into everyday business processes. The measures should be appropriate to the organisation’s operations and the personal data it processes.
Protect Data with Reasonable Security Safeguards [Section 8(5) and Rule 6]
According to Section 8(5), a Data Fiduciary is needed to take reasonable security safeguards to stop a personal data breach. This covers the data held by the Fiduciary itself and by its processors as well.
The Rule 6 of the DPDP Rules 2025, adds practicality to this section. It turns this into practical measures, such as encryption or masking of data, access controls, logging and monitoring of access, and backups. The Data Fiduciary is expected to follow these safeguards and processor contracts should carry the same safeguards.
What counts as “reasonable” depends on the size of the business and the sensitivity of the data it handles.
Example: A small online clothing store that saves customers’ addresses and card-linked payment details needs strong safeguards, like encrypted storage and a trusted payment gateway. A tuition teacher that stores students’ names and parents’ phone numbers would need to safeguard it with a screen lock.
The higher the risk to people if the data leaks, the stronger the protection expected.
Failing to maintain these safeguards can lead to a penalty of up to ₹250 crore under the Act.
Report Personal Data Breaches [Section 8(6) and Rule 7]
Unauthorised processing, accidental disclosure, or loss of access could lead to personal data breaches. A breach could harm the confidentiality, integrity, and availability of data.
Under Section 8(6), the Data Fiduciary must inform the Data Protection Board and each affected person.
The Rule 7 adds more to the reporting requirements. According to Rule 7, the Data Fiduciary should give a detailed report to the Board and it is due within 72 hours of becoming aware of the breach. Rule 7 also requires telling affected Data Principals without delay.
Notification to affected individuals
The Data Fiduciary must inform affected Data Principals without delay, using clear and plain language. The notification must explain the nature and extent of the breach, likely consequences, measures taken or being taken to mitigate risks, recommended steps individuals can take to protect themselves, and contact details for further questions.
Notification to the Board
The Data Fiduciary must inform the Board without delay, including a description of the breach and its likely impact.
Detailed and updated information must be provided within 72 hours of becoming aware of the breach, unless the Board allows a longer period following a written request.
Failing to give this notice can lead to a penalty of up to ₹200 crore.
In a case of data breach, the fiduciary must prepare a plan to handle the situation beforehand. Their plan should go like-
- Who will investigate the breach?
- Who informs the Board?
- How affected users are told?
With a good plan they can mitigate the damages. Having a good plan makes reporting faster. This also helps the board to direct urgent fixes.
Erase Data When It Is No Longer Needed [Section 8(7) and 8(8) and Rule 8]
Businesses cannot store personal data forever.
Under Section 8(7), a Data Fiduciary must erase personal data when the Data Principal withdraws consent or when the specified purpose is no longer being served. The exception to this obligation is when a law requires retention.
Section 8(8) addresses when a purpose is deemed no longer being served, as prescribed under the Rules.
At the time of erasure, Data Fiduciary must erase the personal data and make sure its Data Processors erase it too.
Example – Prevention of Money Laundering Act, 2002 (PMLA), Section 12, PML (Maintenance of Records) Rules, 2005 and the RBI Master Direction on KYC (2016) requires a bank to keep identity records for five years after an account closes.
The DPDP Rules, 2025 (Rule 8) add more detail on erasure, including time limits, so a Data Fiduciary should maintain a Data Retention Policy for its own business. To know more about Data Retention Policy.
Publish Contact Details [Section 8(9)]
Every Data Fiduciary must publish the business contact information of its Data Protection Officer, if applicable, or of a person who can answer the Data Principal’s questions.
These contact details must be provided where people can easily find them.
Handle Grievances [Sections 8(10) and 13]
Section 8(10) states that the fiduciary must set up a simple, working way to raise complaints for Data Principals. This could be a form, an email address, or a helpline.
Section 13 says the individuals must come to the fiduciary before they can go to the Data Protection Board. The complaint system must be efficient enough, because if it is slow or ignored, dissatisfied people will escalate, and more complaints will reach the Board.
Under Rule 14, a fiduciary is needed to reply to each complaint within 90 days.
Respect Data Principal Rights [Sections 11–14 and Rule 14]
Chapter III of the DPDP Act, 2023 gives these rights to Data Principals:
Right to information (Section 11)
The data fiduciary needs to provide a summary of the personal data they hold and who received it.
Right to correction, completion, updating and erasure (Section 12)
A fiduciary must act on requests made by the Data Principals. The only exception to keep the data is because of a stated purpose or to follow a law.
Right of grievance redressal (Section 13)
Data Principals have the right to access the grievance redressal system provided by the Data Fiduciary before approaching the Board.
Right to nominate (Section 14)
A Data Principal can nominate another person to exercise their rights if they die or become unable to act for themselves. Fiduciaries need to honor their request.
Rule 14 adds practical requirements to assist these rights.
Businesses should publish the means through which requests can be submitted, explain the particulars needed to identify the individual, and maintain a process for verifying, tracking, and responding to requests.
Protect Children’s Personal Data (Section 9 and Rule 10)
A child is anyone who is under the age of 18 (under the DPDP Act). Before processing a child’s data, a Data Fiduciary needs verifiable consent from a parent or lawful guardian. For a person with a disability who has a lawful guardian, the guardian can act on their behalf.
Rule 10 specifies requirements for obtaining verifiable parental consent. These requirements are:
- Obtain verifiable consent from a parent or lawful guardian
- Verify that the person providing consent is an adult and is actually a parent or lawful guardian for the child
- The consent must be free, specific, informed, unconditional, and clear. Consent must come from a clear action by the person.
Fiduciaries must not process data in ways that result in harm to a child’s well-being. They cannot track or behaviourally monitor children or show them targeted ads. The government can allow a few exceptions where they can process a child’s data only when certain conditions are met.
Breaking these rules can bring a penalty of up to ₹200 crore.
Additional Obligations For A Significant Data Fiduciary (Section 10 and Rule 13)
The Government can notify certain Data Fiduciaries as “Significant” based on the volume and sensitivity of data, risk to people’s rights, and impact on national security or public order.
If a Data Fiduciary is notified as ‘Significant,’ they must:
- Appoint a Data Protection Officer based in India who reports to the Board of Directors.
- Hire an independent data auditor.
- Run periodic Data Protection Impact Assessments and audits.
- Meeting additional requirements prescribed under the Rules.
Under Rule 13, Significant Data Fiduciaries have to review their data practices every year to make sure they follow the law. They must also check that the software and algorithms they use do not harm people’s rights. The government can also decide that some data must stay inside India. This means the company cannot transfer that data outside India.
Failing these duties can lead to a penalty of up to ₹150 crore.
Manage Cross-Border Transfers of Personal Data (Section 16)
Section 16 allows the Central Government to restrict the transfer of personal data by a Data Fiduciary to certain countries or territories through notification. Other Indian laws that impose stricter requirements may also apply.
Fiduciaries should:
- Map overseas data storage, access, and processing.
- Identify cloud service providers, and processors that are located outside India.
- Check if there are government restrictions and sector-specific legal requirements.
Follow these Obligations and become Compliant Easily
Knowing the obligations is only just the beginning. Applying them every day is the harder part. DPDP.ai helps businesses turn these obligations into working processes. It handles everything from consent and cookie consent management to grievance handling and incident management and more.
Businesses that track compliance in scattered spreadsheets can shift to DPDP.ai. It gives your team one clear view of what is done, what is pending, and how to show proof when asked.
Works for small businesses who are just getting started and for larger organisations with complex data flows as well.
Conclusion
The DPDP Act obligations and rules are not just a draft. They are mandatory guidelines that a business must follow to be DPDP compliant and avoid penalties. The above obligations help businesses know and understand the obligations they need to follow before the enforcement of the DPDP Act.
Failing to follow or missing any rules can result in penalties in 100s of crores, so be compliant before the deadline.
