DPDPA Section 8: Duties of a data fiduciary

A data fiduciary must take reasonable security safeguards to prevent a personal data breach, including where a processor holds the data. Failure to take such safeguards is the single most heavily penalised obligation under the Act.

On becoming aware of a breach, the fiduciary must notify the Data Protection Board and each affected data principal in the form and manner the Rules prescribe. Have an incident-response runbook ready so these notifications can go out within the required timelines.

Personal data must be erased once the purpose is no longer being served and retention is not required by law, and on withdrawal of consent. In practice that means purpose-based retention schedules and a deletion process, not indefinite storage.

ConsentX supports this with configurable retention and an erasure audit trail, so deletion is provable rather than assumed.

A data fiduciary may engage a processor only under a valid contract, and remains accountable for the data. You must publish the contact details of a Data Protection Officer or a person able to answer questions about processing, and operate a grievance-redressal mechanism for data principals.