---
title: "DPDP Act Chapter II: Obligations of Data Fiduciary | dpdpr.in"
description: "Chapter II of the DPDP Act 2023, Obligations of Data Fiduciary: the sections it contains, each with a plain-English summary."
url: "https://dpdpr.in/act/chapter-2/"
canonical: "https://dpdpr.in/act/chapter-2/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Chapter II: Obligations of Data Fiduciary

DPDP Act, 2023 · sections 4 to 10

1. [Section 4 Grounds for processing personal data](https://dpdpr.in/act/section-4/)

Personal data can be used only for a lawful purpose.

2. [Section 5 Notice](https://dpdpr.in/act/section-5/)

Before or when a company asks for consent, it must give a notice.

3. [Section 6 Consent](https://dpdpr.in/act/section-6/)

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action.

4. [Section 7 Certain legitimate uses](https://dpdpr.in/act/section-7/)

This section lists cases where data can be used without asking for fresh consent.

5. [Section 8 General obligations of Data Fiduciary](https://dpdpr.in/act/section-8/)

The Data Fiduciary is responsible for following the Act, even when a processor does the work.

6. [Section 9 Processing of personal data of children](https://dpdpr.in/act/section-9/)

For a child (under 18), the company must get verifiable consent from a parent before using the child's data.

7. [Section 10 Additional obligations of Significant Data Fiduciary](https://dpdpr.in/act/section-10/)

The Government can name some companies, or classes of companies, as Significant Data Fiduciaries.