Your everyday duties
Accountability, accuracy, security, retention and contacts
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
You are responsible, even for your vendors
You stay responsible for compliance, even when a vendor does the processing. Engage processors only under a valid contract.
s.8(1) makes the fiduciary responsible 'irrespective of any agreement to the contrary'. Review vendor contracts for security obligations (Rule 6(f)), breach notification to you, deletion on instruction, audit rights and sub-processor controls.
Accuracy
Credit scores, hiring decisions and insurance pricing all rely on data. If it is wrong, people get hurt, and you are accountable.
This duty is triggered when the data is likely to be used to make a decision that affects the Data Principal, or is disclosed to another Data Fiduciary. Pair it with the right to correction: when someone points out an error, fix it everywhere it flows.
Minimum security safeguards
Rule 6 sets the minimum. Failing to take reasonable security safeguards is the costliest violation in the Act: up to ₹250 crore.
Rule 6 lists measures 'such as' these, so the list is indicative, not a certification standard. 'Reasonable' will be judged against your size, data and risk. Many organisations map Rule 6 to ISO 27001 or similar frameworks, plus appropriate technical and organisational measures under s.8(4).
Keep data only as long as you need it
Once the purpose is served, or consent is withdrawn, erase the data and make your processors erase it too, unless a law requires you to keep it.
Other laws often require retention: tax, company law, KYC under PMLA, labour and sector rules. Build a retention schedule that lists each data type, its purpose, the legal retention period and the deletion trigger.
3 years of inactivity, then erase
For very large platforms, the Rules say the purpose is treated as over if a user has been inactive for 3 years. Give them 48 hours' notice before you delete.
The 3 years run from the user's last approach or use of their rights, or from the date Rule 8 commences, whichever is later. If the user logs in or responds within the 48-hour window, the clock resets.
But don't delete too fast
The Rules also set a minimum. Keep the data, related traffic data and logs for at least one year from processing, even if the account is deleted.
This was added in the final Rules and was not in the January 2025 draft. Combine both rules in your retention schedule: a floor of one year for logs and associated data, and a ceiling based on purpose and the 3-year rule where it applies.
Be reachable
People need a real way to reach you. Publish a contact person and run a grievance redressal process.
Only Significant Data Fiduciaries must appoint a formal Data Protection Officer. Others can name any person able to answer questions. Make sure that person has authority and a process behind them.
In one line
Next: what to do when a breach happens.