DPDP duties
Every duty, the person who owns it, and the record that proves it.
The Act gives the data fiduciary a short list of duties and holds it answerable for each, including work its vendors do. This page turns that list into an operating table: what each duty asks, who usually owns it, and the evidence an examiner from the Data Protection Board of India (the Board) would want to see.
Back to DPDP services01 · Responsibility
Responsibility does not move to a vendor
Section 8(1): no agreement shifts the duty off the fiduciary.
The fiduciary is responsible for compliance across all processing it does or has done for it, whatever any agreement says and even where the individual has not kept her own duties. Two things follow. A processor's failure is your failure in front of the Board. And where consent is your ground, section 6(10) puts the burden on you to prove both the notice and the consent.
- Lawful ground
- Notice
- Valid consent
- Accuracy
- Organisational measures
- Security safeguards
- Breach intimation
- Erasure
- Contact point
- Grievance
- Processor contracts
- Children
02 · The duty table
The duty table
One row per duty: the demand, the owner, the evidence.
| Duty | What it demands | Typical owner | Evidence an examiner would ask for |
|---|---|---|---|
| Lawful ground (s. 4, 7) | Each purpose rests on consent or a listed legitimate use | Privacy lead with product | A processing register showing the ground for each purpose |
| Notice (s. 5; rule 3) | A standalone, plain notice listing the data, the purposes, and how to withdraw, use rights and complain | Privacy lead with legal and design | Notice versions, dates live, language options, screenshots of placement |
| Valid consent (s. 6) | Free, specific, informed, unconditional and unambiguous, by clear action, limited to necessary data | Product owner | Consent and withdrawal logs per person and purpose |
| Accuracy (s. 8(3)) | Complete, accurate, consistent data where it drives a decision about the person or goes to another fiduciary | Owner of each system | Quality checks, correction tickets, reconciliation reports |
| Organisational measures (s. 8(4)) | Technical and organisational measures that make the Act work in practice | Compliance lead | Policies, training records, named roles, internal review results |
| Security safeguards (s. 8(5); rule 6) | Encryption or masking, access control, logging and monitoring, backups, one-year log retention, processor clauses | CISO or head of IT | Access reviews, encryption settings, log retention set-up, backup tests, vendor clauses |
| Breach intimation (s. 8(6); rule 7) | Tell each affected person and the Board without delay; a fuller report to the Board within 72 hours unless the Board extends it | Incident lead with legal | Incident log, notices sent, Board submissions, a timeline from awareness |
| Erasure and retention (s. 8(7), 8(8); rule 8) | Erase on withdrawal or once the purpose is spent unless law needs it kept; make processors erase; keep processing logs at least one year | Data owners with IT | Retention schedule, deletion job output, processor deletion confirmations |
| Contact point (s. 8(9); rule 9) | Publish who answers questions about processing, and name them in every rights response | Privacy lead | The published page and response templates |
| Grievance redressal (s. 8(10), 13; rule 14) | A working complaint route and a published response period of no more than 90 days | Support with the privacy lead | The published period and ticket data showing response times |
| Processor contracts (s. 8(2)) | A valid contract before any processor works on data for your offering | Procurement with legal | Signed contracts, sub-processor lists, due-diligence files |
| Children and guardians (s. 9; rules 10, 11) | Verifiable consent of a parent or lawful guardian; no harmful processing, tracking or ads aimed at children | Product owner | Age-gate design, verification records, ad-targeting settings |
Owners are typical, not required by law. What matters is that each row has one named person.
03 · What gets asked
What an examiner is likely to ask first
Five requests that test many rows at once.
- Show one person's trail. Pick a customer: the notice they saw, the consent they gave, every system holding their data, and what happens when they leave.
- Show a deletion. A record whose purpose ended, and proof it is gone, including at the processor.
- Show a vendor. The contract, the safeguards it promises, and how you checked them.
- Show an incident. Even a small one: when you knew, who decided, who was told and when.
- Show a complaint. Received, answered and closed within the period you published.
The Rules give the Board six months to complete an inquiry from the date it receives a complaint or intimation, extendable in steps of up to three months. Evidence that already exists is the only evidence that helps in that window.
04 · Owners
Who carries the work in a mid-size company
Duties fail where ownership is shared and nobody leads.
- Privacy or compliance leadHolds the register, the notices, the contact point and the request log. Chairs the monthly review.
- Product and engineeringBuild consent capture, withdrawal, deletion jobs and age gates into the product itself.
- SecurityRuns the safeguards in rule 6 and the incident process behind breach intimation.
- SupportTakes requests and complaints, and logs every one in the same queue.
- Procurement and legalKeep processor contracts current and check vendors before data moves.
- LeadershipFunds the work and signs off the risk decisions, such as how long to keep data.
05 · When duties start
When each duty starts to bite
The operating rules arrive eighteen months after the Rules were published.
Rules 3 and 5 to 16, which carry the detail for notice, security, breach intimation, retention, children, significant fiduciaries and rights, come into force eighteen months after the Rules were published in November 2025, so around May 2027. Each duty in the table needs a process, an owner and a record by then. Building the evidence trail takes longer than writing the policy.
06 · Go deeper
Where each duty is covered in depth
This page is the index; these guides are the detail.
- Valid consent and noticesWhat a notice says and what makes consent count.
- Reasonable security safeguards, in practiceWhat the duty asks, and how ISO 27001 and SOC 2 evidence it.
- Personal data breaches under the DPDP ActWho must be told, what they are told, and your records.
- Retention and erasureWhen data must go, and how to prove that it did.
- Grievance redressal and the contact pointWho people write to, and how complaints are handled.
- Significant data fiduciariesThe extra duties: DPO, audits and impact assessments.
Sources: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), sections 4 to 9, 13, 17 and the Schedule; the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), rules 1, 3, 6 to 11, 14 and 19.
Questions about fiduciary duties
Do small companies get lighter duties?
Not by default. The Government can exempt some, including startups, by notification.
Section 17(3) lets the Government exempt notified fiduciaries, including startups, from the notice duty, the accuracy and erasure duties, the significant fiduciary duties and the access right. Until a notification names you, plan for the full list.
Is ISO 27001 enough to meet the security duty?
It helps a great deal, but rule 6 sets its own minimum list.
An ISO 27001 management system covers most of rule 6: access control, encryption, logging, backups and supplier terms. Check the specifics the Rules add, such as keeping logs for one year and writing safeguards into processor contracts.
Do these duties apply when we process without consent?
Most of them, yes.
A legitimate use replaces consent, not the rest. Security, accuracy, erasure, breach intimation, the contact point and grievance redressal still apply. The notice duty in section 5 is tied to requests for consent.
Who should own DPDP in a startup?
One named person, usually the founder or a compliance lead at first.
Small teams do best with one owner who keeps the register and chases the rest. Engineering owns the product changes, and whoever runs security owns the safeguards and incidents.
What is the highest penalty?
The Schedule's highest ceiling is 250 crore rupees, for failed security safeguards.
The Schedule sets a ceiling per type of breach: up to 250 crore rupees for failing to take reasonable security safeguards, and up to 200 crore rupees each for failing to report a breach and for breaching the duties around children. The Board decides the amount within the ceiling.
Give every duty an owner and a record.
A DPDP readiness assessment tests each row of this table against how your company actually works. Counsel should confirm how the law applies to your contracts.