Navigating legal liabilities: Understanding DPDP execution

In this ‘Leading Questions’ section, Sidhant Dhingra and Shikher Upadhyay explain DPDP execution by outlining Data Fiduciary responsibilities, Significant Data Fiduciary duties, strict protections for children’s data, and rules for data erasure and retention.

Question: What constitutes "Reasonable Security Safeguards" under Section 8(5), DPDP Act and Rule 6, DPDP Rules?

Answer: Rule 6 sets baseline legal requirements for Section 8(5) compliance. At a minimum, Data Fiduciaries must implement:

• Technical safeguards, including encryption, obfuscation, masking, or tokenisation.

• Access control mechanisms and continuous system monitoring.

• Mandatory log retention for at least one year for breach detection and investigation.

• Business continuity plans to ensure processing stability during security incidents.

• Binding contractual clauses requiring Data Processors to adopt equivalent safeguards.

Because "reasonableness" is evaluated retrospectively during regulatory inquiries, maintaining detailed security documentation is essential.

Question: How do companies reconcile parallel breach-reporting mandates across regulators?

Answer: Under Section 8(6) , DPDP Act and Rule 7, DPDP Rules, a Data Fiduciary must notify both the Data Protection Board of India and every affected Data Principal "without delay" upon becoming aware of a personal data breach. A comprehensive report detailing the cause, extent, and remedial steps must be submitted to the Board within 72 hours.

In parallel, specified cybersecurity incidents must be reported to CERT-In within 6 hours under the 2022 IT Directions.

Incident Awareness

├──> CERT-In (Within 6 hours - Cyber Incident)

├──> Data Protection Board & Principals ("Without delay" - Data Breach Notice)

└──> Data Protection Board Detailed Report (Within 72 hours - Forensic Filing)

Question: How does the framework allocate statutory liability between Data Fiduciaries and Processors?

Answer: Section 8, DPDP Act keeps full statutory responsibility on the Data Fiduciary. Delegating data operations to third-party vendors, cloud providers, or platforms does not shift legal liability before the Board.

Fiduciaries must update Data Processing Agreements (DPAs) to mandate that Processors:

1. Implement Rule 6-equivalent security controls.

2. Provide immediate notice of any security incident.

3. Support the Fiduciary with erasure requests, rights enforcement, and compliance audits.

Question: What legal conditions trigger a Significant Data Fiduciary (SDF) designation under Section 10, DPDP Act?

Answer: The Central Government may designate any Data Fiduciary as an SDF under Section 10(1) based on processing volume, data sensitivity, public order, electoral integrity, or national security risks. SDF designation triggers additional statutory duties under Section 10 and Rule 13, DPDP Rules, including:

• Appointing an India-resident Data Protection Officer (DPO).

• Engaging an independent auditor for annual data protection audits.

• Conducting annual Data Protection Impact Assessments (DPIAs).

• Performing periodic diligence on automated profiling and recommendation algorithms.

Question: What are the statutory restrictions governing children's personal data under Section 9, DPDP Act?

Answer: Section 9 defines a child as any individual under 18 years of age and mandates verifiable parental consent prior to processing.

Section 9 establishes strict statutory prohibitions regardless of parental consent:

• A complete ban on tracking or behavioural monitoring.

• A complete ban on targeted advertising directed at children.

• A restriction on any processing likely to cause detrimental effects to a child's well-being.

Violations carry statutory penalties up to ₹200 crore.

Question: What statutory mechanics govern data erasure upon consent withdrawal or purpose expiry?

Answer: Under Section 8(7), DPDP Act and Rule 8, DPDP Rules, personal data must be erased when the Data Principal withdraws consent or when the underlying purpose expires.

For designated platform categories, the Third Schedule establishes fixed retention limits, such as mandatory erasure after three years of user inactivity. Fiduciaries must issue a formal notice to the Data Principal at least 48 hours prior to executing time-based erasures. Erasure workflows must cover active systems, backups, and downstream processor environments, except where longer retention is mandated by law.

Sidhant Dhingra is a Senior Partner and Shikher Upadhyay is a Senior Associate at Foresight Law Offices India.