Data Fiduciary Obligations
Master the comprehensive framework of Data Fiduciary obligations under DPDPA 2023. Learn the dual processing grounds (consent & legitimate uses), notice requirements, security safeguards, breach notification protocols, and special protections for children's data.
📋 Module Overview
Chapter II of the DPDPA 2023 establishes the foundational obligations every Data Fiduciary must observe. Unlike the rights-centric GDPR, India's approach places significant emphasis on fiduciary duties — a concept borrowed from trust law that imposes higher standards of care, good faith, and loyalty.
As Justice Chandrachud observed in K.S. Puttaswamy v. Union of India (2017): "Privacy is the constitutional core of human dignity." This module translates that constitutional mandate into practical compliance frameworks.
📜 Legal Provisions Covered
- Section 4 — Grounds for Processing Personal Data
- Section 5 — Notice Requirements
- Section 6 — Consent Framework
- Section 7 — Legitimate Uses (Processing Without Consent)
- Section 8 — General Obligations of Data Fiduciary
- Section 9 — Processing of Children's Personal Data
- Section 10 — Significant Data Fiduciary Obligations
Philosophical Foundation: The DPDPA draws from the Kantian principle of treating individuals as ends in themselves, never merely as means. A Data Fiduciary processes personal data in a position of trust — the Data Principal entrusts their digital identity to the fiduciary's care.
🎯 Key Concepts You'll Master
⚖️ Dual Processing Grounds
Understand the two lawful bases for processing: consent under §6 and legitimate uses under §7 — and when each applies.
📝 Notice-Consent Architecture
Master the mandatory notice requirements (§5) that must precede or accompany every consent request.
🤝 Consent Manager Framework
Learn about the unique Indian innovation of registered Consent Managers under §6(7)-(9) and Rule 4.
🔒 Security Safeguards
Implement "reasonable security safeguards" under §8(5) — a standard informed by industry practices.
🚨 Breach Notification
Navigate the dual notification requirement to Board and Data Principals under §8(6).
👶 Children's Data Protection
Apply heightened protections for children (under 18) including verifiable parental consent under §9.
⚠️ Penalty Framework (The Schedule)
Module Lessons
Grounds for Processing & Consent Framework
Explore the two lawful bases for processing under §4, master the seven characteristics of valid consent under §6, and understand the legitimate uses framework under §7.
Notice Requirements & Transparency
Master the mandatory notice architecture under §5, language requirements, itemized disclosure obligations, and the special notice regime for pre-Act processing.
Security Safeguards & Breach Management
Implement "reasonable security safeguards" under §8(5), understand the dual breach notification obligations, data retention limits, and the Data Processor relationship.
Children's Data & Parental Consent
Navigate the special protections for children under §9 — verifiable parental consent, prohibition on behavioral monitoring, advertising restrictions, and class exemptions under Rules.
Significant Data Fiduciary Obligations
Understand the enhanced obligations for SDFs under §10 — Data Protection Officer appointment, annual DPIAs, algorithmic audits, and data localization requirements.
📝 Module 2 Assessment
Test your mastery of Data Fiduciary obligations with 50 comprehensive questions covering all five lessons. A score of 70% or higher is required to unlock Module 3.