Section 8 of the DPDP Act, Explained Subsection by Subsection for Businesses and Their Vendors

What is section 8 of the DPDP Act?

Section 8 sits in Chapter II of the Act, which deals with the obligations of a Data Fiduciary, the person who decides the purpose and means of processing (section 2(i)). Other sections cover notice (section 5), consent (section 6), children (section 9) and Significant Data Fiduciaries (section 10). Section 8 holds the general obligations that apply to every fiduciary, whatever its size. In short, the section 8 DPDP Act duties are the baseline data fiduciary obligations under the DPDP regime, and the starting point for any compliance programme. The Act has no turnover or headcount threshold.

Under notification G.S.R. 843(E), section 8 is among the provisions scheduled to commence on 13 May 2027, eighteen months after the Rules were published on 13 November 2025. As of October 2026 no notification has changed that date, though the government proposed in early 2026 to shorten the window. Check the current position before you plan around it.

Section 8(1): responsibility for your vendors

The Act text: a Data Fiduciary shall, “irrespective of any agreement to the contrary”, be responsible for complying with the Act and Rules “in respect of any processing undertaken by it or on its behalf by a Data Processor”.

For the business, this means outsourcing does not outsource accountability. If a Hyderabad hospital group’s billing vendor mishandles patient data, the hospital group answers to the Board. A clause saying the vendor is solely responsible does not change that.

For the vendor, the Act imposes no direct duties on a Data Processor. Its exposure runs through the contract and through the customer’s own liability, which is why customers will push for audit rights, instruction rights and indemnities.

Section 8(2): only under a valid contract

The Act text: a fiduciary may engage a Data Processor “for any activity related to offering of goods or services to Data Principals only under a valid contract”. This is the section 8(2) valid contract requirement.

The Act does not require a written data processing agreement, a signature or any particular clauses. A contract valid under the Indian Contract Act, 1872 is likely to be enough for section 8(2), though the Act does not define a valid contract. In practice, a written agreement or addendum is the recommended way to show the arrangement exists and what it covers. Rule 6(1)(f) separately asks for an appropriate provision in the contract for reasonable security safeguards, wherever applicable.

For the vendor, the practical point is that a customer cannot lawfully use you without some contract in place, and click-through terms that never mention personal data will be questioned at renewal.

Section 8(3) and 8(4): accuracy and organisational measures

Section 8(3) applies where personal data is likely to be “used to make a decision that affects the Data Principal” or “disclosed to another Data Fiduciary”. The fiduciary must then ensure its completeness, accuracy and consistency. A Pune lender scoring loan applicants through a vendor’s tool is the obvious case. The vendor contract should, as recommended practice, oblige the vendor to support corrections and accuracy checks.

Section 8(4) requires “appropriate technical and organisational measures to ensure effective observance” of the Act and Rules. This is the general governance duty: policies, training, records, assigned owners. For vendors, it usually appears as a duty to follow the customer’s reasonable data protection policies.

Section 8(5): reasonable security safeguards

The Act text: a fiduciary shall protect personal data “in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach”.

Rule 6 sets the minimum. It lists encryption, obfuscation, masking or virtual tokens; access control over computer resources; logs, monitoring and review to detect unauthorised access; continuity measures such as backups; retention of those logs and personal data for one year unless another law requires otherwise; an appropriate provision in the fiduciary and processor contract for security safeguards; and technical and organisational measures.

This is the duty with the largest penalty in the Schedule, up to ₹250 crore. For vendors, it means an appropriate security provision in the contract is expected under Rule 6(1)(f), wherever applicable. A detailed schedule tracking the Rule 6 list item by item is recommended practice, and customers are likely to ask for one.

Section 8(6): breach intimation

The Act text: in the event of a personal data breach, the fiduciary “shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed”.

Rule 7 prescribes it: notice to each affected individual and a first notice to the Board without delay, then a detailed report to the Board within 72 hours of becoming aware, which the Board may extend on a written request. The duty is the fiduciary’s alone. The law sets no deadline for a vendor to tell its customer, so a fixed vendor notice period, often 24 hours, is a contractual term and recommended practice. See our guide on breach notification for the full Rule 7 table.

What does section 8(7) erasure require, and how do the illustrations work?

The Act text: unless retention is necessary for compliance with any law, the fiduciary shall “(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and (b) cause its Data Processor to erase any personal data that was made available by the Data Fiduciary”.

The Act gives two illustrations. In the first, a woman lists her used car on an online marketplace and consents to her data being used for the sale. Once the sale is concluded, the purpose is served and the marketplace should no longer keep her data. In the second, a woman closes her savings account. Banking law requires the bank to keep identity records for ten years after closure, so the bank keeps them for that period, because retention is required by law.

Rule 8(3) adds a floor. Personal data, traffic data and processing logs, including processing by a processor, must be kept for at least one year from the date of processing for the purposes in the Seventh Schedule, then erased. The Rule’s own illustration has a company ensuring that its cloud host keeps customer records and logs for a year before erasure. So the vendor clause should require erasure on instruction and at exit, subject to the one-year minimum and any legal retention duty.

Section 8(8) and 8(11): when a purpose is deemed to be over

Section 8(8) says the purpose is deemed no longer served if the Data Principal does not approach the fiduciary for that purpose and does not exercise her rights for a prescribed period. Section 8(11) clarifies that she has not approached the fiduciary in any period during which she has not initiated contact, in person or by electronic or physical communication.

Rule 8(1) and the Third Schedule prescribe that period only for large platforms: e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. For them it is three years of inactivity, with at least 48 hours’ notice to the user before erasure under Rule 8(2). Vendors serving those platforms need to support that cycle.

Section 8(9) and 8(10): a contact person and grievance redressal

Section 8(9) requires the fiduciary to publish the business contact information of a Data Protection Officer, if applicable, or a person able to answer Data Principals’ questions about processing. Rule 9 requires it to be prominently published on the website or app and mentioned in every response to a rights request.

Section 8(10) requires “an effective mechanism to redress the grievances of Data Principals”. Rule 14(3) requires the fiduciary to publish a response period not exceeding ninety days. A vendor that runs your support desk or holds the data must help you answer within that period, which is a recommended contract term.

Section 8 at a glance: duties, Rules and vendor clauses

Which three subsections matter most for vendor contracts?

Section 8(1) matters because it removes the escape route. You cannot contract out of responsibility, so the contract has to give you the control and information to discharge it.

Section 8(2) matters because it is the gateway. Without a valid contract, the engagement itself is outside what the Act permits, and the contract is where every other duty gets allocated.

Section 8(5) security safeguards matter because they carry the highest penalty, up to ₹250 crore under the Schedule, and because Rule 6(1)(f) expressly reaches into the fiduciary and processor contract. A breach of section 8(6) can attract up to ₹200 crore, and other breaches of section 8 up to ₹50 crore. All are maximums imposed by the Board after an inquiry, only for a breach it finds significant.

Startups should note section 17(3). The government may notify classes of fiduciaries, including startups, to whom sections 5, 8(3), 8(7), 10 and 11 shall not apply. As of October 2026 no such notification is known, and it would not lift sections 8(1), 8(2), 8(5) or 8(6).

What does a DPDP compliance check actually give you?

Section 8(1) means your business answers for every vendor that touches personal data. Penalties can reach up to ₹250 crore for security failures, and many vendor contracts signed before November 2025 are likely to say nothing about the DPDP Act.

An advocate’s review is thorough and the right choice for material deals, but slower and costlier per contract. A free checklist is fast, though you still read every clause and judge every gap yourself. The ClauseAudit DPDP Compliance Check reads a vendor agreement, data processing agreement or SaaS terms clause by clause in minutes, for ₹999 per contract plus GST. Each finding is labelled required by the Act or Rules, with the section or rule, or recommended practice, so it does not claim the law demands more than it does. You get the clause quoted, why it matters, a suggested fix, a redline and a negotiation email, read from the customer or the vendor side. The original document is not stored after the review.

It is an AI-assisted review and can miss things. For large or sensitive deals, children’s data at scale or regulated sectors, have an advocate review the contract.

Related reading

See our guides on the DPDP compliance checklist, data fiduciary vs data processor roles, data processing agreement clauses, DPDP penalties and the enforcement timeline, and our free data processing addendum template. This guide explains the law in general terms and is not legal advice.