Key Responsibilities of a Data Fiduciary

1. Lawful Purpose of Processing

• Process personal data only for lawful purposes that are:
  • Consented to by the Data Principal (individual), or
  • Permitted under legitimate use as defined under the Act (e.g., compliance with law, medical emergencies, employment, etc.)

2. Consent Management

• Obtain valid, informed, and specific consent from data principals before processing their data.
• Provide the option for data principals to withdraw consent at any time.
• Ensure consent notices are clear, in plain language, and available in multiple languages (as prescribed).

3. Notice Obligations

• Provide notice to data principals at the time of data collection, stating:
  • Purpose of processing
  • Nature and type of personal data being collected
  • Rights of the data principal
  • Details of cross-border transfer (if any)

4. Data Minimization and Purpose Limitation

• Collect only such personal data that is necessary and relevant for the intended purpose.
• Do not retain personal data beyond the period necessary for the stated purpose, unless mandated by law.

5. Accuracy of Data

• Ensure that the personal data processed is accurate and kept up to date.

6. Security Safeguards

• Implement reasonable security safeguards to prevent:
  • Unauthorized access
  • Breach of confidentiality
  • Alteration or destruction of personal data

7. Grievance Redressal Mechanism

• Establish a grievance redressal system for data principals.
• Ensure grievances are addressed within 7 days.

8. Reporting Data Breaches

• Report personal data breaches to the Data Protection Board of India (DPBI) and affected individuals as soon as possible.

9. Data Principal Rights Fulfilment: Facilitate data principals’ rights:

• Right to access information about their personal data
• Right to correction and erasure
• Right to withdraw consent
• Right to nominate a person to exercise rights in case of incapacity or death

10. Children’s Data & Data of Persons with Disabilities

• Obtain verifiable parental consent for processing data of children (below 18 years) and ensure no harmful tracking or targeted advertising.
• Ensure appropriate consent from legal guardians for persons with disabilities.

11. Cross-border Data Transfers

• Permitted unless restricted by the Central Government through notification (blacklist mechanism).

12. Retention Policies

• Cease retention of personal data once the purpose is fulfilled and no legal requirement exists for further storage.