What is a Data Fiduciary under the DPDP Act?
A Data Fiduciary is the person or organisation that decides why and how personal data is processed. Section 2 of the DPDP Act 2023 defines it as anyone who, alone or with others, determines the purpose and means of processing. Your company is a Data Fiduciary for its customer and employee data, and it carries the legal duties.
Who counts as a Data Fiduciary?
Anyone who decides the purpose and means of processing digital personal data of people in India counts as a Data Fiduciary, whatever its size. That includes:
- a company collecting customer data through its website, app or stores;
- an employer holding employee and candidate records;
- a hospital, school, bank or NBFC holding patient, student or customer data;
- a foreign company processing data of people in India in connection with offering them goods or services;
- a government body processing personal data, unless an exemption applies.
The test is control, not who holds the server. If you choose what data to collect and what to do with it, you are the Data Fiduciary even when a vendor stores it.
What is the difference between a Data Fiduciary, a Data Processor and a Data Principal?
The Data Fiduciary decides, the Data Processor acts on its instructions, and the Data Principal is the person the data is about.
| Role | What it does | Example | Main legal position |
|---|---|---|---|
| Data Fiduciary | Decides the purpose and means of processing | An online retailer | Carries the duties under the Act and is answerable to the Board |
| Data Processor | Processes personal data on behalf of a Data Fiduciary | The retailer's cloud, CRM or payroll provider | Works under a valid contract; the Data Fiduciary stays responsible |
| Data Principal | The person the data relates to | The retailer's customer | Holds rights such as access, correction and erasure |
| Significant Data Fiduciary | A Data Fiduciary named by the government for its volume or risk | A large platform | Has extra duties under Section 10 |
The same company can play different roles. A payroll provider is a Data Processor for its clients' employee data, and a Data Fiduciary for its own staff data.
What does a Data Fiduciary have to do?
A Data Fiduciary must process personal data only on a lawful ground and meet the duties in Section 8 of the Act and the DPDP Rules 2025:
- Lawful ground: process data only with valid consent or for a legitimate use listed in Section 7.
- Notice: give an itemised notice of the data and the purpose before asking for consent (Rule 3).
- Accuracy: keep data complete, accurate and consistent when it is used to make a decision about the person or is shared.
- Security safeguards: take reasonable security safeguards to prevent a personal data breach, including at processors (Section 8(5), Rule 6).
- Breach reporting: tell the Board and each affected person about every personal data breach (Section 8(6), Rule 7).
- Erasure: erase data once the purpose is served or consent is withdrawn, unless a law requires keeping it (Section 8(7)).
- Contact and grievances: publish a contact for data questions and run a grievance process.
- Processors: engage a Data Processor only under a valid contract.
- Children: get verifiable parental consent, and avoid tracking, behavioural monitoring and targeted advertising directed at children (Section 9).
Most of these duties apply from 13 May 2027, under the phased timeline of the DPDP Rules 2025.
Is a Data Fiduciary responsible for its vendors?
Yes. The Act makes the Data Fiduciary responsible for compliance in respect of processing done on its behalf by a Data Processor. Write security safeguards, breach notice and deletion into every vendor contract, and keep a list of which vendor holds which data.
When does a Data Fiduciary become a Significant Data Fiduciary?
Only when the government notifies it. The government can name a Data Fiduciary, or a class of them, as a Significant Data Fiduciary based on factors such as the volume and sensitivity of the data and the risk to people. That brings extra duties, such as a Data Protection Officer based in India and an independent data auditor.
How GRC Flow helps
GRC Flow maps each Data Fiduciary duty in the Act and Rules to your own answers and records, and shows which are met and which need work. Its DPDP registers keep consent, requests, breaches and vendors in one place, with an owner and due date for each entry. See the full approach on our DPDP compliance page.
Frequently asked questions
What is the meaning of Data Fiduciary in the DPDP Act?
A Data Fiduciary is any person who, alone or together with other persons, decides the purpose and means of processing personal data. In practice it is the company or organisation that decides why personal data is collected and how it is used.
What is the difference between a Data Fiduciary and a Data Processor?
The Data Fiduciary decides why and how personal data is processed. The Data Processor only processes it on the Data Fiduciary's behalf, under a valid contract. The Data Fiduciary remains responsible for compliance, including for what its processors do.
Is a Data Fiduciary the same as a data controller under GDPR?
Broadly, yes. Both terms describe the party that decides the purpose and means of processing. The duties differ in detail between the DPDP Act and GDPR.
Can a small business be a Data Fiduciary?
Yes. The DPDP Act has no turnover or headcount threshold. Any organisation that decides how digital personal data of people in India is used is a Data Fiduciary.
What is the penalty for a Data Fiduciary that breaks the DPDP Act?
It depends on the duty. The maximum is ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for not reporting a breach or breaking the duties for children's data, and ₹50 crore for other breaches of the Act or Rules.
Sources
- Deloitte India: Point of view on the DPDP Act
- KPMG India: DPDP Rules 2025 guidance
- PIB: Digital Personal Data Protection Rules, 2025
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.