Module 7: Obligations of Data Fiduciaries

Module 7 of 10 · Intermediate · 4 hours · Obligations of Data Fiduciaries

The day-to-day duties in Section 8 and a practical governance programme you can start this quarter. This DPDPA 2023 course page explains obligations of data fiduciaries in plain language.

obligations of data fiduciaries - DPDPA 2023 course lesson banner

Module 7 lessons (about 4 hours) (obligations of data fiduciaries)

Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.

Lesson	Time
Lesson 7.1: Accountability: the fiduciary carries the load	30 min
Lesson 7.2: Accuracy and completeness	30 min
Lesson 7.3: Retention and erasure: Rule 8 and the Third Schedule	30 min
Lesson 7.4: Contact point and grievance mechanism	30 min
Lesson 7.5: Data inventory and records	30 min
Lesson 7.6: Vendors and processor contracts	30 min
Lesson 7.7: Governance, training and records	30 min
Lesson 7.8: Fiduciary obligations practice and module test	30 min

Start Lesson 7.1 →

What you will learn about obligations of data fiduciaries

List the Section 8 duties
Draft a processor contract checklist
Publish contact and grievance details
Run a basic compliance programme

Core duties (Section 8)

A fiduciary must:

Process only for a lawful purpose and be able to demonstrate compliance
Ensure accuracy and completeness where data affects a decision or is shared
Apply reasonable security safeguards
Notify breaches
Erase data when the purpose is served or consent is withdrawn
Publish the business contact of the Data Protection Officer or a designated person
Provide a grievance redressal mechanism
Use processors only under a valid contract

Compliance programme in 7 steps (obligations of data fiduciaries)

Data inventory, notice templates, consent management, rights workflow, vendor contracts, incident plan, retention schedule. Add staff training and an owner for each.

Vendor oversight

Contracts with processors should cover purpose limits, security, sub-processors, breach reporting, deletion and audit rights.

Key takeaway
Accountability is the theme: write down what you do, and be able to show it.

Check your understanding of obligations of data fiduciaries

Q1. Who must appoint a Data Protection Officer based in India?

Q2. A processor may be engaged only under…

Q3. Must a fiduciary publish a contact for questions?

Quick FAQs (obligations of data fiduciaries)

Do small businesses have to comply?

Yes, unless specifically exempted, though the Government may notify relaxations for certain classes.

Do we need a data inventory?

Not named in the Act, but you cannot honour rights or breach duties without one.

Do it yourself: practical guides

← Cross-Border Transfers & Exemptions Children’s Data & Significant Data Fiduciaries →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for obligations of data fiduciaries: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.