Section 8 General obligations of Data Fiduciary
8. (1) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, irrespective of any agreement to the contrary or failure of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... undertaken by it or on its behalf by a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
(2) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data may engage, appoint, use or otherwise involve a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary to process personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data on its behalf for any activity related to offering of goods or services to DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals only under a valid contract
(3) Where personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data is likely to be-
(a) used to make a decision that affects the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf; or
(b) disclosed to another Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data,
the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data shall ensure its completeness, accuracy and consistency.
(4) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.
(5) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall protect personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data in its possession or under its control, including in respect of any processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... undertaken by it or on its behalf by a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary, by taking reasonable security safeguards to prevent personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
(6) In the event of a personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data, the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall give the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and each affected Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, intimation of such breach in such form and manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(7) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, unless retention is necessary for compliance with any law for the time being in force,-
(a) erase personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, upon the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and
(b) cause its Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary to erase any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that was made available by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... to such Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
Illustration
(I) X, an individual, registers herself on an online marketplace operated by Y, an e-commerce service provider. X gives her consent to Y for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for selling her used car. The online marketplace helps conclude the sale. Y shall no longer retain her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
(II) X, an individual, decides to close her savings account with Y, a bank. Y is required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X's personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the said period
(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf does not--
(a) approach the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for the performance of the specified purpose; and
(b) exercise any of her rights in relation to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure....
for such time period as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, and different time periods may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act for different classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries and for different purposes.
(9) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall publish, in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, the business contact information of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10, if applicable, or a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who is able to answer on behalf of the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, the questions, if any, raised by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf about the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
(10) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall establish an effective mechanism to redress the grievances of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals.
(11) For the purposes of this section, it is hereby clarified that a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall be considered as not having approached the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for the performance of the specified purpose, in any period during which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has not initiated contact with the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for such performance, in personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses or by way of communication in electronic or physical form.