Section 8 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 8(5) requires every Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach. It carries the highest penalty in the Schedule, a ceiling of two hundred and fifty crore rupees. A legal consultation can help you document what "reasonable" means for your business.
A Data Fiduciary must protect personal data in its possession or under its control, including data processed by a Data Processor on its behalf, by taking reasonable security safeguards to prevent personal data breach (section 8(5)). The Act does not list the safeguards. Breach of this duty carries a penalty that may extend to Rs 250 crore (Schedule, item 1). Section 8(5) stays in force even where section 17(1) exempts most of Chapter II.
The text in parts
| Element of section 8(5) | Meaning |
|---|---|
| "A Data Fiduciary shall protect" | Duty on the Data Fiduciary, not on the Data Processor directly |
| "personal data in its possession or under its control" | Covers data you hold and data you control even if held elsewhere |
| "including in respect of any processing undertaken by it or on its behalf by a Data Processor" | Vendors' handling is covered |
| "by taking reasonable security safeguards" | Standard is reasonableness; no list of measures |
| "to prevent personal data breach" | The outcome to be prevented |
"Possession or control"
Holding data on your own servers is possession. "Control" reaches further. If a cloud host stores the data and you decide how it is used and who can access it, it is under your control. So the duty does not depend on where the servers are. Together with the wording on processors, it means you cannot say the leak happened at the vendor. Section 8(1) says the same in general terms. See section 8(1) and (2).
What is a personal data breach
Section 2(u) defines it as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data". Three points follow:
- It is wider than theft. Accidental disclosure, for example an email sent to the wrong list, qualifies.
- Loss of access counts. A ransomware lock-out that compromises availability can be a breach even if nobody copies the data.
- Unauthorised processing counts, which can include an insider viewing records without a work need.
See the definitions of data and processing.
What is "reasonable"
The Act does not define reasonable security safeguards and lists no control, certificate or standard. The details, if any, are for the rules; the DPDP Rules, 2025 (notified November 2025) prescribe detail and different provisions commence on different dates, so check the Rules. What the statute gives you is the test itself: reasonableness, judged against the aim of preventing a breach.
Factors that point towards what is reasonable in a given business, though the Act does not name them, include the kind of data (financial or health data needs more), the volume, the harm a leak could cause, the size and resources of the business, and what the sector normally does. Section 33(2) separately directs the Board, when fixing a penalty, to consider the type and nature of the personal data affected, the nature, gravity and duration of the breach, repetition, and the mitigation taken and how timely it was. A record of decisions made before any incident is strong evidence that safeguards were considered.
Commonly considered areas, offered as practical examples and not as a statutory list:
- access control and least privilege, strong authentication;
- encryption of data at rest and in transit;
- backups and recovery tested from time to time;
- logging and monitoring, so unauthorised access can be seen;
- patching and secure configuration;
- vendor security review and contract terms;
- staff training and clear rules on sharing data;
- an incident response plan that covers the section 8(6) notice.
Section 8(5) and section 8(4)
Section 8(4) asks for technical and organisational measures so the whole Act is observed. Section 8(5) is narrower and sharper: it targets prevention of breach. The difference shows in the Schedule. Section 8(4) falls under item 7 (fifty crore rupees) while section 8(5) falls under item 1. See accuracy and organisational measures.
Section 8(5) and section 8(6)
Section 8(5) is about preventing the breach; section 8(6) is about telling the Board and each affected Data Principal after it happens. A business can breach one without the other. A company with strong controls that hides a breach violates section 8(6) only. A company that gives prompt notice of a breach caused by weak controls may still be found to have violated section 8(5). See breach intimation.
Consequence of breach
Item 1 of the Schedule: breach in observing the obligation of a Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8, "may extend to two hundred and fifty crore rupees". Note three things:
- It is a ceiling ("may extend"). The actual amount depends on section 33(2).
- The Board imposes it only after an inquiry and a hearing, and only where it finds the breach of the Act significant (section 33(1)).
- Under section 27(1)(a), on receiving a breach intimation the Board may direct urgent remedial or mitigation measures and inquire into the breach.
An appeal lies to the Appellate Tribunal within sixty days under section 29. See penalties.
Practical examples
Example 1: unencrypted backup. A small business leaves a customer database on an external drive that is lost. No controls protected it. The question is whether the safeguards taken were reasonable for the data it held.
Example 2: vendor misconfiguration. A processor's storage bucket is left open to the internet. The business is answerable, because section 8(5) covers processing on its behalf by a Data Processor.
Example 3: wrong attachment. An employee emails salary data to the wrong recipient. This is an accidental disclosure, so a personal data breach. Whether it also shows a failure of safeguards depends on what controls existed, for example review of attachments, or limits on who can export data.
Common mistakes
- Waiting for the rules or a "standard checklist" before doing anything.
- Covering only own servers and ignoring vendors and staff devices.
- Keeping no written record of why safeguards were chosen.
- Having a prevention plan but no plan for intimation and recovery.
Need help with security safeguards?
If you do not know whether your controls would be called reasonable, a gap review against your actual data flows is a good first step. Our legal consultation team can help you record your risk decisions and align them with the Act.
Key takeaways
- Reasonable security safeguards are a statutory duty of every Data Fiduciary, including startups and smaller businesses.
- The duty covers data in possession or under control and processing by Data Processors.
- The Act sets no list; the test is reasonableness to prevent personal data breach.
- Item 1 of the Schedule sets a ceiling of Rs 250 crore.
- Keep evidence of how you chose your safeguards.
Read next
- Section 8 of the DPDP Act, 2023: intimation of personal data breach
- Section 8 of the DPDP Act, 2023: accuracy and organisational measures
- Data breach notification obligation under the DPDP Act
- Penalties under the DPDP Act
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.