Section 8 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 8(1) makes the Data Fiduciary answerable for compliance with the Act, including for processing done on its behalf by a Data Processor. Section 8(2) adds that a Data Processor may be engaged for offering goods or services only under a valid contract. If vendors, payroll bureaus, cloud hosts or call centres handle your customer data, an NDA and processing arrangement is the place to start.
A Data Fiduciary is responsible for complying with the Act and the rules irrespective of any agreement to the contrary and irrespective of the Data Principal failing her own duties (section 8(1)). That responsibility covers processing done by a Data Processor on its behalf. A Data Processor may be engaged for activity related to offering goods or services to Data Principals only under a valid contract (section 8(2)). Breach of the Act attracts the penalty in the Schedule; for a provision with no specific entry, up to Rs 50 crore.
Sub-sections (1) and (2) at a glance
| Sub-section | What it says | Who it binds |
|---|---|---|
| 8(1) | Responsible for compliance, despite contrary agreement or Data Principal's failure of duties, including processing by a Data Processor | Data Fiduciary |
| 8(2) | Data Processor can be engaged, for activity related to offering goods or services to Data Principals, only under a valid contract | Data Fiduciary |
Who is the Data Fiduciary, who is the Data Processor
Section 2(i) defines a Data Fiduciary as any person who, alone or with others, determines the purpose and means of processing. Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. The test is who decides why and how the data is used. A payroll software vendor that processes salary data only on your instructions is a processor; a bank that decides what to do with customer data is a fiduciary. The same entity can be a fiduciary for its own customers and a processor for another business. See the definitions article.
Section 8(1): responsibility cannot be contracted away
Three phrases do the work.
- "Irrespective of any agreement to the contrary." A clause in a vendor contract that says the vendor alone is liable for compliance does not shift the fiduciary's statutory responsibility towards the Board and the Data Principal. You may allocate cost and indemnity between yourselves, but the Act itself continues to treat you as responsible.
- "Or failure of a Data Principal to carry out the duties provided under this Act." Section 15 lists duties of the Data Principal, such as not impersonating another person and not filing false grievances. If she fails in one, that does not excuse the fiduciary from its own obligations. The two sets of duties run separately. See section 15.
- "Processing undertaken by it or on its behalf by a Data Processor." The responsibility follows the data. A breach at the vendor is, for the Act's purposes, the fiduciary's problem.
Note also section 17(1): even where section 17(1) switches off most of Chapter II for particular processing, sub-sections (1) and (5) of section 8 remain in force. Responsibility and security safeguards are the two obligations that stay.
Section 8(2): "only under a valid contract"
The Data Fiduciary may "engage, appoint, use or otherwise involve" a Data Processor to process personal data on its behalf "for any activity related to offering of goods or services to Data Principals" only under a valid contract. Points to note:
- The verbs are wide. Engaging, appointing, using or otherwise involving covers formal outsourcing and informal arrangements, such as a staff member forwarding data to a freelance designer.
- The contract must be valid. The Act does not define a valid contract, so ordinary contract law decides validity: competent parties, lawful object, and so on. It does not list mandatory clauses. It also does not prescribe a form, so the detail is for the parties, and anything further would come from the rules.
- The scope phrase matters. Section 8(2) speaks of activity "related to offering of goods or services to Data Principals". The text does not say what follows for processing that is not related to offering goods or services, for example purely internal work. Do not assume either way; a written contract is sensible for every processor in any case.
What the Act leaves open, a good contract fills. Typical clauses worth considering are: processing only on documented instructions for the specified purpose; confidentiality; security safeguards matching section 8(5); help with Data Principal requests; breach reporting by the processor to the fiduciary; erasure on instruction (section 8(7)(b) requires the fiduciary to cause the processor to erase data); and return of data at exit. These are drafting suggestions, not requirements the Act spells out. A sample is discussed in our post on a data processing agreement template.
How this links to other provisions
- Security: section 8(5) covers data "under its control", including processing by a Data Processor. See reasonable security safeguards.
- Erasure: section 8(7)(b) makes the fiduciary cause its processor to erase. See erasure and retention.
- Withdrawal of consent: section 6(6) makes the fiduciary cause its processors to cease processing. See withdrawal of consent.
- Breach: section 8(6) intimation is the fiduciary's duty, so the contract should oblige the processor to tell you promptly.
Consequence of breach
The Schedule has no separate entry for section 8(1) or 8(2). Item 7 covers breach of any other provision of the Act or the rules: penalty may extend to fifty crore rupees. If the failure is a security failure, item 1 (section 8(5)) applies and may extend to two hundred and fifty crore rupees; a failure to give breach notice falls under item 2, up to two hundred crore rupees. Under section 33(1), the Board imposes a penalty only where, on concluding an inquiry, it finds the breach significant, and section 33(2) lists factors such as nature, gravity and duration, and mitigation. See penalties.
Practical examples
Example 1: cloud vendor. An e-commerce business stores customer details with a hosting provider. The vendor suffers a leak. The Act treats the processing as undertaken "on behalf of" the business, so the business is the one answerable, whatever the vendor agreement says about blame.
Example 2: email handed to a freelancer. A marketing manager exports a customer list and sends it to a freelancer for a campaign, with no written terms. That is "involving" a processor with no valid contract.
Example 3: Data Principal gives wrong data. A customer enters a false phone number. Her failure under section 15 does not remove the business's duty to comply with the Act for the data it holds.
Common mistakes
- Relying on an "all liability is the vendor's" clause.
- Letting teams share data with vendors without a contract on file.
- Keeping no list of processors, so withdrawal and erasure instructions cannot reach everyone.
- Treating the fiduciary-processor split as a label in the contract rather than a fact about who decides purpose and means.
Need help with processor contracts?
Many businesses discover their vendor terms say nothing about personal data only after an incident. Our team can review your vendor agreements and draft confidentiality and processing terms through our NDA and confidentiality drafting service.
Key takeaways
- The Data Fiduciary stays responsible for compliance, whatever the contract says.
- A Data Principal's failure of her duties does not excuse the fiduciary.
- A Data Processor may be engaged for goods or services activity only under a valid contract.
- The Act does not list the contract's clauses, so drafting matters.
- Penalty for a provision with no specific entry may extend to fifty crore rupees.
Read next
- Section 8 of the DPDP Act, 2023: reasonable security safeguards
- Section 8 of the DPDP Act, 2023: erasure and retention of personal data
- Obligations of a Data Fiduciary under section 8
- Data processing agreement template for DPDP compliance
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.