Data Fiduciary Obligations Under the DPDP Act: A Practical Guide
· Sri Tulasi Tech Labs
The Data Fiduciary — the organisation that decides why and how personal data is processed — carries the main responsibility under the DPDP Act. It remains responsible even when a Data Processor does the processing for it, and even if a Data Principal fails to perform their own duties.
1. Lawful processing and notice
Process personal data only with valid consent or for a legitimate use, and give a clear notice of the data and the purpose.
2. Accuracy and completeness
Where personal data is used to make a decision about the person, or is disclosed to another Data Fiduciary, the organisation must ensure it is complete, accurate and consistent.
3. Reasonable security safeguards
Protect personal data in your possession or control — including with your processors — with reasonable security safeguards to prevent breaches. The DPDP Rules, 2025 describe minimum measures, including:
- encryption, obfuscation, masking or virtual tokens where appropriate;
- access controls for computer resources;
- logs and monitoring to detect unauthorised access, kept for at least a year;
- backups and measures to keep processing going if data is compromised;
- appropriate clauses in contracts with Data Processors.
Failing to take reasonable security safeguards attracts the highest penalty under the Act — up to ₹250 crore.
4. Data Processors only under contract
Engage processors only under a valid contract, and make sure they follow your instructions and protect the data.
5. Breach notification
Inform the Data Protection Board and each affected Data Principal of a personal data breach, in the form and time the Rules prescribe.
6. Erasure when the purpose is served
Erase personal data — and have your processors erase it — once consent is withdrawn or the purpose is no longer being served, unless the law requires you to keep it. For certain large platforms, the Rules set a period after which data is treated as no longer needed, with notice to the person before erasure.
7. A point of contact and a grievance process
Publish the business contact details of a Data Protection Officer, if you have one, or of a person who can answer questions about processing. Set up an effective grievance redressal mechanism.
8. Cross-border transfers
Personal data may be transferred outside India except to countries the Central Government restricts by notification. Stricter sector laws (such as those for banking data) continue to apply.
Turning obligations into practice
Start with a data inventory, assign an owner for each processing activity, review processor contracts, document your security measures and run a breach drill.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.