InfraVeritas360DPDPiq

DPDP Insights › The law › Section 8(1)–(2)

What it means in your sector

• Banking, financial services and insurance: Collection agencies, KYC vendors, BCs, DSAs, call centres and cloud providers work for you. RBI, SEBI and IRDAI outsourcing rules apply alongside.
• IT, ITeS, BPO and GCC: You are usually the processor for client data and a fiduciary for your own staff. Your sub-contractors are your processors.
• Central government: ministries and departments: System integrators, NIC and state departments that process data for a scheme act for the ministry; contracts and MoUs should say so.
• Public sector undertakings and utilities: Distributors, franchisees, meter vendors, ticketing vendors and labour contractors process data for you.
• Healthcare and hospitals: Labs, billing vendors, teleradiology providers and hospital software vendors process data for you.

Questions where this section matters

• Someone withdraws consent. What has to stop, and how fast?
• What must a vendor contract say about personal data?
• Can personal data be stored or accessed outside India?
• Are contract and agency workers our responsibility?
• How much effort and time will it take to be ready by 13 May 2027?
• What should the board of directors ask management about DPDP?
• How do we put DPDP into the risk register?
• Are we a Data Fiduciary or a Data Processor?
• Can we cross-sell insurance, cards or mutual funds to existing customers?
• What can collection agents do with borrower data?
• Does DPDP apply to data of foreign clients' customers?
• How should our people access client systems?
• A client's data is involved in an incident. Who tells whom?
• Can we share data with states, banks or other ministries?

Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.