Processing is lawful on only two grounds: consent, or a legitimate use listed in Section 7 of the Act. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. Every request for consent needs a notice that is clear and plain, and that can be read on its own. It must also be available in English or any language in the Eighth Schedule to the Constitution. Withdrawing consent must be as easy as giving it.
Data Principals have the right to access a summary of their data and processing, to correct, complete, update and erase their data, to grievance redressal, and to nominate another person to act for them. Fiduciaries must publish how Data Principals can exercise these rights, answer each request within the period they publish, which may not exceed 90 days, and publish the contact details of the person who answers questions about processing.
The core duties for every Data Fiduciary are reasonable security safeguards, accuracy where data is used for decisions, erasure once the purpose is served, a working grievance mechanism, and notification of every personal data breach to the Data Protection Board and to each affected Data Principal. The Rules set out the content of those breach notices and require a detailed report to the Board within 72 hours of becoming aware of a breach.
Retention has its own mechanics. Where a Data Principal has not engaged with certain large platforms for the period the Rules set, the fiduciary must erase their data and give them at least 48 hours' notice before it does. Every fiduciary must also keep the logs of its processing for at least one year, to support breach investigations.
Children's data carries extra duties. A fiduciary must obtain verifiable consent from a parent before processing a child's data, and must not track, monitor behaviour or target advertising at children. The Rules list narrow exemptions, for example for healthcare, education and child safety.
