They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
DPDP ACT 2023 · DATA FIDUCIARY OBLIGATIONS
DPDP Act 2023 · Sections 4–10 · Data Fiduciary Obligations
Data Fiduciary
Obligations
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineComplete guide to all obligations imposed on Data Fiduciaries under the DPDP Act 2023. Understanding these requirements is essential for organizational compliance.
Sections 4–10 cover lawful processing, notice, consent, security safeguards, children’s data, and Significant Data Fiduciary duties.
7Sections of duties (4–10)
₹250 CrMax penalty / instance
1,000+Audits delivered
DPDP Act 2023 · Sections 4–10 · Last reviewed June 2026
Direct Answer
What must a data fiduciary do?
A data fiduciary is the organization that decides why and how personal data is processed — the DPDP Act 2023 equivalent of a GDPR controller — and Sections 4 to 10 set out its duties. In short, a data fiduciary must process personal data only for a lawful purpose, give clear notice, obtain valid consent, keep data accurate and secure, erase it once the purpose is served, protect children’s data, and, if designated a Significant Data Fiduciary, appoint a DPO and an independent auditor and run impact assessments.
Key Takeaways
- A data fiduciary determines the purpose and means of processing — broadly the GDPR controller — and is bound by Sections 4–10 of the DPDP Act 2023.
- Core duties: lawful purpose, clear notice, valid consent, data accuracy, reasonable security safeguards, deletion after purpose, and a published contact person.
- Children’s data (under 18) requires verifiable parental consent, with no tracking, behavioural monitoring, or targeted advertising.
- Significant Data Fiduciaries carry extra Section 10 duties: an India-based DPO, an independent auditor, and Data Protection Impact Assessments.
Sections 4–10
Obligations Section by Section
Section 4
Grounds for Processing Personal Data
Personal data can only be processed for lawful purposes with the consent of the Data Principal or for certain legitimate uses.
- Processing only for lawful purpose
- Consent must be free, specific, informed, unconditional, and unambiguous
- Data Principal must have clear affirmative action
- Consent can be withdrawn at any time
Section 5
Notice Requirements
Data Fiduciaries must provide clear notice to Data Principals before or at the time of collecting personal data.
- Itemised description of personal data collected
- Purpose of processing must be specified
- Information about rights and grievance redressal
- Notice in clear and plain language
Section 6
Consent Requirements
Consent must be obtained before processing and can be managed through registered Consent Managers.
- Consent must be specific to each purpose
- Can be obtained through Consent Manager
- Must be easy to withdraw consent
- Records of consent must be maintained
Section 7
Legitimate Uses
Personal data may be processed without consent for specified legitimate uses including state functions and legal obligations.
- Voluntary data provided by Data Principal
- State functions including subsidies and benefits
- Legal obligations and court orders
- Medical emergencies and public health
Section 8
General Obligations
All Data Fiduciaries must implement security safeguards, ensure data accuracy, and delete data when purpose is fulfilled.
- Implement reasonable security safeguards
- Ensure completeness and accuracy of data
- Delete personal data after purpose is served
- Appoint contact person for queries
Section 9
Processing Children's Personal Data
Special protections for processing personal data of children (under 18 years) including verifiable parental consent.
- Verifiable consent from parent/guardian required
- No tracking or behavioral monitoring of children
- No targeted advertising to children
- Exemptions for certain classes of Data Fiduciaries
Section 10
Significant Data Fiduciary Obligations
Additional obligations for organizations designated as Significant Data Fiduciaries based on data volume and sensitivity.
- Appoint Data Protection Officer in India
- Appoint independent data auditor
- Conduct Data Protection Impact Assessment
- Periodic audits and compliance reports
At a Glance
Data Fiduciary Obligations at a Glance
Every core obligation under the DPDP Act 2023, mapped to its section.
| Section | Obligation |
|---|---|
| Section 4 | Process personal data only for a lawful purpose with consent or a permitted legitimate use |
| Section 5 | Give a clear, itemised notice before or at the time of collecting personal data |
| Section 6 | Obtain free, specific, informed, unconditional, and unambiguous consent, and enable easy withdrawal |
| Section 7 | Rely on legitimate uses (e.g. state functions, legal obligation, medical emergency) only where applicable |
| Section 8 | Maintain data accuracy, apply reasonable security safeguards, erase data after purpose, appoint a contact person |
| Section 9 | Obtain verifiable parental consent for children, with no tracking, behavioural monitoring, or targeted ads |
| Section 10 | If a Significant Data Fiduciary: appoint a DPO in India and an independent auditor, run DPIAs and periodic audits |
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on data fiduciary duties, SDFs, DPOs, and penalties.
What is a data fiduciary under the DPDP Act?
A data fiduciary is any person or organization that, alone or with others, determines the purpose and means of processing personal data — broadly equivalent to a controller under the GDPR. If your organization decides why and how digital personal data of people in India is processed, you are a data fiduciary and the obligations in Sections 4–10 of the DPDP Act 2023 apply to you.
What are the core obligations of a data fiduciary?
A data fiduciary must process personal data only for a lawful purpose, give clear notice, obtain valid consent (or rely on a permitted legitimate use), keep data accurate, apply reasonable security safeguards, erase data once the purpose is served, handle children’s data with verifiable parental consent, and respond to data-principal rights and grievances. Significant Data Fiduciaries carry additional duties under Section 10.
What is a Significant Data Fiduciary (SDF)?
A Significant Data Fiduciary is a data fiduciary the Central Government designates based on factors such as the volume and sensitivity of personal data processed and the risk to data principals or to the sovereignty and security of India. SDFs must appoint a Data Protection Officer based in India, appoint an independent data auditor, and conduct Data Protection Impact Assessments and periodic audits.
Do data fiduciaries have to appoint a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a Data Protection Officer, and that DPO must be based in India and report to the board or equivalent. Every data fiduciary, however, must appoint a contact person (or DPO) whose details are published so data principals can raise questions and grievances.
What are the penalties for breaching data fiduciary obligations?
The Data Protection Board can impose penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data failures, and lower slabs for other defaults. These are ceilings, not a sum per breach, and one incident touching several obligations can engage more than one entry.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act and Rules 2025.
- DPDP compliance consulting in India — meet every fiduciary obligation with auditor-led implementation.
- DPDP penalty calculator — model your exposure across obligations.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
Significant Data Fiduciary
Enhanced obligations for large-scale data processors under the DPDP Act.
Read morePrivacy
DPDP Consent Management
Lawful consent collection, withdrawal and record-keeping under the DPDP Act.
Read morePrivacy
Data Principal Rights
Access, correction, erasure and grievance redressal rights.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read moreDPDP course · Module 3 of 8
Previous · Module 22.3 Consent under the DPDP ActCourse map8 modules · 79 lessons · 24 readyNext3.9 Significant data fiduciaries and their extra duties
Next in the course: 3.2 Data processors: who counts and what the contract must say. Parth Chauhan is writing it.