Chapter II: Obligations of Data Fiduciary

DPDP Act, 2023 · sections 4 to 10

1. Section 4 Grounds for processing personal data

   Personal data can be used only for a lawful purpose.

2. Section 5 Notice

   Before or when a company asks for consent, it must give a notice.

3. Section 6 Consent

   Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action.

4. Section 7 Certain legitimate uses

   This section lists cases where data can be used without asking for fresh consent.

5. Section 8 General obligations of Data Fiduciary

   The Data Fiduciary is responsible for following the Act, even when a processor does the work.

6. Section 9 Processing of personal data of children

   For a child (under 18), the company must get verifiable consent from a parent before using the child's data.

7. Section 10 Additional obligations of Significant Data Fiduciary

   The Government can name some companies, or classes of companies, as Significant Data Fiduciaries.