Section 8 — DPDP Act, 2023
(1) A Data Fiduciary shall, in respect of personal data of Data Principal— (a) make reasonable efforts to ensure the accuracy and completeness of personal data; (b) build in necessary safeguards as may be prescribed by the Board; (c) inform the Board and each affected Data Principal in the form and manner as may be prescribed, in the event of a personal data breach; (d) erase personal data upon the Data Principal withdrawing consent or upon the purpose ceasing to be served. (3) Every Data Fiduciary shall be responsible for the personal data processed by a Data Processor on its behalf and shall ensure that such Data Processor processes personal data only for the purposes specified by the Data Fiduciary. (4) Every Data Fiduciary shall, before engaging a Data Processor, ensure that there exists a valid contract between the Data Fiduciary and the Data Processor. (5) Every Data Fiduciary shall protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach. (6) In the event of a personal data breach, a Data Fiduciary shall— (a) give intimation of such breach in such form and manner as may be prescribed, to the Board; and (b) give intimation to each Data Principal whose personal data is affected by such breach. (7) A Data Fiduciary shall not retain personal data beyond the period necessary to serve the purpose for which it was collected, or such period as may be specified by the Central Government.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 8 is the operational backbone of the Act — eleven obligations that sit on top of the lawful basis requirements. The most operationally intensive are: the processor contract requirement (Section 8(4) means you need a valid data processing agreement with every vendor who touches personal data on your behalf), the security safeguards obligation (Section 8(5), detailed in Rule 6), breach notification (Section 8(6), detailed in Rule 7), and storage limitation (Section 8(7)). A Data Fiduciary remains accountable for a Data Processor's actions — outsourcing processing does not outsource compliance.
A healthcare startup uses a cloud analytics firm to process patient engagement data. Under Section 8(4), a written contract is mandatory before processing begins. The contract must specify exactly what data the processor can handle and for which purposes. Existing vendor agreements signed before the Act commenced that do not contain these terms need to be renegotiated.
If a Data Processor (e.g., a cloud hosting vendor) suffers a breach that exposes a Data Fiduciary's data, it is the Data Fiduciary that must notify the Board under Section 8(6) — not the processor. The Data Fiduciary is responsible for the processor's handling of the data and cannot point to the vendor contract as a defence.
An e-commerce company retains user purchase history indefinitely 'for personalisation'. Unless a specific legal obligation requires retention, the data must be erased once the purchase purpose is served. Rule 8 and the Third Schedule specify mandatory retention timelines for certain categories of platforms — for others, the Data Fiduciary must determine what 'necessary' means in their context.
Compliance Center
Section 8(6) breach notification: two-step notification workflow — immediate Board disclosure, then detailed report to Board and affected Data Principals.
Minimum Security Safeguards
Section 8(5) security obligation: structured against Rule 6's seven minimum controls with evidence collection for each.