A summary of core obligations for organisations that determine how and why personal data is processed.
Core obligations
- Process personal data only for lawful purposes with valid consent or a recognised legitimate use.
- Implement reasonable security safeguards to prevent personal data breaches.
- Notify the Data Protection Board and affected individuals in the event of a personal data breach.
- Erase personal data when the purpose is no longer served, unless retention is required by law.
- Publish contact details for grievance redressal and respond to requests from individuals.
- Ensure Data Processors act only under a valid contract — a well-drafted data processing agreement.
Significant Data Fiduciaries
Organisations notified as Significant Data Fiduciaries have additional duties, including appointing a Data Protection Officer based in India, appointing an independent data auditor and conducting periodic Data Protection Impact Assessments.
This article provides general information and does not constitute legal advice.