Module 5 of 9Section 88 min including the detail
The duties that apply no matter what
Section 8 is where the Act stops being about permission and starts being about competence. These duties do not depend on which lawful ground you relied on.
You are accountable for your processors
Outsourcing moves the work, not the duty. Your contract is the only mechanism that makes it enforceable downstream.
The detail, if you want it
A Data Fiduciary is responsible for complying with the Act, including where a Data Processor processes on its behalf. Outsourcing moves the work and not the duty. Engaging a Processor requires a valid contract, and in practice that contract is your only mechanism for making the duty enforceable downstream.
This is the clause that turns a vendor list into compliance work. Every third party that touches personal data on your behalf needs a contract that reaches the obligations in this section, including erasure, and you need to be able to name them.
Accuracy, where a decision or a disclosure follows
Not a general duty to hold perfect data. It bites exactly where the data is about to be acted on or passed on.
The detail, if you want it
Where personal data is likely to be used to make a decision that affects the person, or is likely to be disclosed to another Data Fiduciary, you must ensure it is complete, accurate and consistent.
The trigger is worth noticing. The duty is not a general one to hold perfect data. It bites specifically where the data will be acted on or passed on, which is exactly where inaccuracy causes harm.
Reasonable security safeguards, and the price of not having them
The highest penalty in the Act, and it is higher than the penalty for failing to report a breach. That tells you what the Act thinks is worse.
the ceiling for failing to take reasonable security safeguards
Judged after an incident, against what an organisation of your size and sophistication should have done.
The detail, if you want it
You must protect personal data in your possession or under your control by taking reasonable security safeguards to prevent a personal data breach. That includes data held by a Processor for you.
This carries the highest penalty in the Act: up to ₹250 crore. It is higher than the penalty for failing to notify a breach, which tells you what the Act considers the more serious failure. The word reasonable is doing the work, and it is judged after an incident, against what an organisation of your size and sophistication should have done.
A published contact, and a grievance route that works
Published means a stranger can find it. Effective means it answers. A regulator can check both from the outside in ten minutes.
The detail, if you want it
You must publish the business contact information of a Data Protection Officer, if you have one, or of a person able to answer questions about processing. Published means findable by someone outside your organisation, not recorded internally.
You must also provide an effective mechanism to redress grievances. Effective is a higher bar than existing. A route that never replies fails this, and it is the failure a regulator can verify from the outside in about ten minutes.
The three things to remember
- You are accountable for your Processors, and that accountability needs a contract that reaches these duties.
- The accuracy duty bites where data drives a decision about someone or is disclosed onward.
- Security safeguards carry the highest ceiling in the Act, Rs 250 crore, above the penalty for not reporting.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A list of every Processor touching personal data for you, each with an executed contract covering these duties.
- A published contact route, reachable from your public site, that a stranger can use and that is monitored.
- A record of grievances received, what was done, and how long it took.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.