Section 8 — General Obligations of Data Fiduciary

Sections 4 through 7 answer whether an organisation is allowed to process personal data in the first place. Section 8 answers what it has to do once it is. It applies to every Data Fiduciary, full stop — there's no size threshold, no sector carve-out, no "we're too small for this" exception written into the text. Section 9 layers extra duties on top for children's data and Section 10 layers extra duties on top for Significant Data Fiduciaries, but Section 8 is the floor everyone stands on regardless.

Accountability that can't be contracted away — 8(1)

A Data Fiduciary is responsible for complying with the Act "irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties" the Act gives her. Two things follow from that wording. First, no vendor contract, indemnity clause, or terms-of-service disclaimer shifts this liability away from the Fiduciary — you can allocate cost between yourselves privately, but the Board still holds the Fiduciary accountable. Second, a Data Principal's own carelessness — reusing a leaked password, ignoring a security notice — doesn't excuse the Fiduciary from its own obligations either.

Processors only under a valid contract — 8(2)

A Data Fiduciary may engage a Data Processor to handle personal data on its behalf, but only under a valid contract. There's no informal-arrangement exception — a cloud vendor, KYC agency, or mailing-list tool processing data on your instructions needs a written contract in place, and Rule 6(1)(f) expects that contract to specifically address security safeguards, not just commercial terms.

Data quality where it actually matters — 8(3)

Where personal data feeds a decision affecting the Data Principal, or gets disclosed to another Data Fiduciary, it has to be complete, accurate and consistent. This obligation is scoped, not universal — the Act isn't demanding perfect data hygiene everywhere, just wherever a decision or a downstream disclosure rides on the data being right.

Technical and organisational measures — 8(4)

A general duty to implement measures that make the Act's other provisions actually work in practice — access controls, role-based permissions, documented processes — rather than obligations that exist only on paper.

Security safeguards to prevent a breach — 8(5)

A Data Fiduciary must protect personal data in its possession or under its control — including data a Data Processor handles on its behalf — through reasonable security safeguards. Rule 6 spells out what "reasonable" covers in practice: encryption or similar protection, access controls, monitoring for unauthorised access, and data-processing agreements with processors. This is one of only two Section 8 duties (alongside 8(1)) that Section 17(1) refuses to exempt even for government functions otherwise carved out of Chapter II — the legislature treated basic security as non-negotiable.

Breach intimation — 8(6)

When a breach happens, the Data Fiduciary has to notify the Board and every affected Data Principal, in the form and manner Rule 7 prescribes. That rule splits notification into an immediate step and a 72-hour follow-up report — covered in full on our Rule 7 explainer — and it's the single most operationally demanding duty in this section, because it runs on a clock that starts the moment you become aware, not the moment you've finished investigating.

Erasure once the purpose ends — 8(7), 8(8), 8(11)

Unless retention is separately required by law, a Data Fiduciary must erase personal data once consent is withdrawn, or once it's reasonable to assume the specified purpose no longer applies — and it must cause its Data Processors to do the same with any data it handed them. Sub-section (8) defines when a purpose counts as "no longer served": once the Data Principal stops approaching the Fiduciary for that purpose and stops exercising her rights, for a period Rule 8 and the Third Schedule prescribe per class of Fiduciary. Sub-section (11) clarifies that silence counts — a Data Principal is deemed not to have approached the Fiduciary during any period she initiated no contact at all, in person or electronically.

A published contact point — 8(9)

The business contact information of a Data Protection Officer (where one's required) or another person able to answer questions has to be published, in the manner Rule 9 prescribes — not buried in a privacy policy's final paragraph.

A working grievance mechanism — 8(10)

An "effective mechanism to redress the grievances of Data Principals" is a functional requirement, not a form on a webpage nobody monitors — the Act cares whether grievances actually get resolved, not just whether a channel technically exists.

Why this matters in practice

Section 8 is where enforcement will concentrate, because it's where the Schedule's steepest penalties attach — a security failure under 8(5) or a mishandled breach under 8(6) can draw penalties up to ₹250 crore under Section 33, scaled by the seven factors Section 33(2) lists. Most organisations already have something in place for notice, consent, and rights requests; far fewer have tested whether their breach-response plan would actually meet Rule 7's timelines under real pressure, or whether their processor contracts genuinely cover what 8(2) and Rule 6(1)(f) require rather than just referencing "applicable law" in general terms.

Illustration: a company outsources payroll processing to a third-party vendor. The vendor is a Data Processor; the company remains the Data Fiduciary and stays on the hook under 8(1) for the vendor's compliance. If the vendor suffers a breach exposing employee salary data, it's the company — not the vendor — that has to notify the Board and every affected employee under 8(6), on Rule 7's timeline, regardless of whose system actually failed.

How Section 8 connects to the rest of the Act

Section 4 sets the lawful basis Section 8's obligations then attach to; Section 7's legitimate uses feed into the same processing Section 8 governs. Section 9 adds extra restrictions on top of 8's baseline for children's data, and Section 10 adds extra obligations on top of it for Significant Data Fiduciaries — in both cases, Section 8 still applies underneath, not instead of. On the Rules side, Rule 6 details the security safeguards 8(5) requires, Rule 7 details the breach-notification process 8(6) requires, Rule 8 details the retention timelines behind 8(7)-8(8), and Rule 9 details the publication format 8(9) requires.