A Data Fiduciary is the person or organisation that decides why personal data is processed and how that processing is carried out. Under Section 2(i) of India's DPDP Act, those decisions can be made alone or together with others.
If your business decides to collect customer details to fulfil orders, assess loan applications or run a recruitment process, it will generally be the Data Fiduciary for that activity. Paying another company to store or process the information does not transfer that responsibility.
The useful question is more specific than “Is our company a Data Fiduciary?” Ask: “For this particular use of personal data, who decides the purpose and means?” A business can be a fiduciary for one activity and a processor for another.
Updated 3 October 2026. The main business obligations discussed here are scheduled to commence in May 2027 under the government's commencement notification. This guide explains the framework businesses should prepare for.
The difference between a Data Fiduciary and a Data Processor
A Data Processor processes personal data on behalf of a Data Fiduciary. The definitions appear in Sections 2(i) and 2(k) of the DPDP Act.
Imagine a payroll software company. Its customer decides which employees to pay, why their bank details are needed and which payroll records must be maintained. The software company calculates salaries and hosts records under that customer's instructions. For that work, the customer is the fiduciary and the software company is a processor.
The software company also employs its own staff and collects leads through its website. It decides what happens to those records. For those activities, it is a fiduciary itself.
| Question | Data Fiduciary | Data Processor |
|---|---|---|
| Why is the data being processed? | Decides the purpose, alone or with others | Carries out the agreed processing on the fiduciary's behalf |
| What establishes the role? | The actual decisions about purpose and means | The activity performed on behalf of the fiduciary |
| Does outsourcing change accountability? | Remains responsible under Section 8(1) | Has responsibilities under the processing contract and other applicable law |
| What happens when a new use is proposed? | Must assess the basis and obligations for that use | Cannot assume instructions for one service authorise its own unrelated use |
| Can the organisation have both roles? | Yes, for different activities | Yes, for different activities |
A contract helps describe these boundaries. It cannot make a business a processor for an activity where that business actually determines the purpose and means.
A practical test for your business
Choose one activity, such as sending renewal reminders, hosting a client's customer database or screening job applicants. Write down the answers to these questions:
- What is the purpose? “Customer data” is a category. “Send an annual subscription renewal reminder” is a purpose.
- Who decided to pursue it? Identify the legal entity making that decision, including anyone making it jointly.
- Who determines the means? Look at the decisions about the processing arrangement. Technical involvement alone does not settle the role.
- Is another company acting on instructions? Describe what it can do and whether it has any independent purpose for the data.
- What changes when the contract ends? Identify who can require return or deletion and which records each party may lawfully retain.
If your team cannot answer the fourth question for a vendor, review the service terms, product behaviour and data flows together. A contract that calls the vendor a “processor” deserves another look if the vendor also uses identifiable customer records to build its own unrelated product.
When I first wrote this guide, I had reviewed the privacy documentation of over 30 Indian SaaS companies in the previous quarter. Not one used the term “Data Fiduciary” correctly in its privacy policy. Several still used the old IT Act's “body corporate” terminology; others relied on GDPR controller language. The practical lesson is to check the underlying role assessment as well as the label on the page.
Four situations where the answer needs care
A SaaS vendor uses customer records to improve its product
Hosting a client's records on instructions and independently reusing those records are different activities. Investigate what “product improvement” covers: service diagnostics, training a model, building cross-customer profiles or something else.
A processor does not automatically become a fiduciary because it chooses a database engine. Equally, calling independent reuse “analytics” does not keep it within the customer's instructions. Map the specific purpose and decisions before assigning the role.
Two companies jointly design a service
Section 2(i) includes decisions made “in conjunction with other persons.” Where two businesses jointly determine the purpose and means, both can fall within the definition.
For example, two companies may jointly design a loyalty programme and decide which customer attributes it collects and how they are used. Their agreement should allocate operational work, contacts and evidence. That allocation needs to reflect the actual arrangement; it does not erase statutory responsibility.
A small business uses large cloud providers
A small employer can be a fiduciary for employee records even when a much larger vendor hosts the software. Size does not determine the basic role.
The Act provides powers to notify certain exemptions, including for some classes of fiduciaries under Section 17(3). That is different from a blanket exemption for every startup or small business. Check whether a specific exemption applies to your activity instead of using headcount as the test.
A business is outside India
Under Section 3, the Act's scope includes processing outside India connected with offering goods or services to Data Principals within India. Overseas incorporation alone does not settle applicability.
The Act also has specific exclusions, including personal or domestic processing and certain personal data made publicly available by the individual or under a legal obligation. “We found it online” is not a sufficient explanation for relying on the public-data exclusion. The source and circumstances matter.
What does a Data Fiduciary have to do?
The obligations extend beyond consent. A useful way to organise them is around the decisions your teams already make.
| Business decision | Relevant provision | What to put in place |
|---|---|---|
| Why may we process this data? | Sections 4 to 7 | A recorded purpose and applicable consent or legitimate-use basis; a suitable notice where consent is sought |
| Who may process it for us? | Section 8(2) | A valid processor contract that reflects the actual service |
| Can someone rely on this information? | Section 8(3) | Accuracy, completeness and consistency controls where data is likely to affect a decision about the individual or be disclosed to another fiduciary |
| How will the organisation comply? | Section 8(4) | Appropriate technical and organisational measures, with clear owners |
| How will we protect the data? | Section 8(5) and Rule 6 | Security safeguards across your own systems and processing performed on your behalf |
| What happens after a breach? | Section 8(6) and Rule 7 | Notification procedures, contact details and evidence of the response |
| When must processing stop or data be erased? | Sections 6(6), 8(7) and 12; Rule 8 | Withdrawal, erasure and retention decisions that account for applicable legal requirements |
| How can a person reach us? | Sections 8(9), 8(10) and 11 to 14; Rules 9 and 14 | Published contact information and working routes for rights requests and grievances |
The references above are to the Act and the final DPDP Rules 2025.
Three distinctions are worth getting right when turning that table into tasks.
Consent is one route to lawful processing. Section 7 also lists certain legitimate uses. Record the particular ground and its conditions rather than collecting a checkbox for every activity or treating “business need” as a general exception.
The breach rule has more than one clock. Rule 7 provides for notification to affected individuals and an initial intimation to the Board without delay. The detailed Board update is due within 72 hours of awareness, unless the Board permits longer on a written request. “We have 72 hours to tell anyone” is an unsafe response plan.
Erasure has to account for legal retention. Section 8(7) includes a legal-retention exception. Rule 8(3) also requires a minimum one-year retention period for the personal data, associated traffic data and processing logs it covers, for the Seventh Schedule purposes. Work out the applicable retention duties before promising immediate deletion of every copy. Restrict retained records to their justified purposes.
What your processor contract needs to settle
Section 8(1) keeps responsibility with the fiduciary for processing undertaken by it or on its behalf. Section 8(2) requires a valid contract when a processor is engaged for processing related to offering goods or services to Data Principals.
That makes vendor contracting a practical control. For each processor, establish:
- Which data it receives and the permitted purposes.
- Which security safeguards it must maintain, including the contractual provisions contemplated by Rule 6.
- How quickly it must tell you about an incident so you can meet your own obligations.
- How it will assist with retrieval, correction and erasure.
- What happens to records and backups at termination, including any applicable retention requirement.
- How additional processors are authorised and how you obtain evidence of completion.
These are contract-design recommendations. The Act does not prescribe this exact six-item template. Our guide to drafting a data processing agreement explains how to turn the arrangement into clauses.
A vendor's email saying “deleted” is more useful when it identifies which systems and records were covered, what was retained and why. Decide what evidence you need before the first request arrives.
Does every fiduciary need a Data Protection Officer?
The Act specifically requires a Significant Data Fiduciary to appoint a Data Protection Officer based in India. Significant Data Fiduciary status depends on a government notification under Section 10, informed by factors including the volume and sensitivity of data and risks to individuals.
An ordinary fiduciary still needs to publish the business contact information required by Section 8(9) and Rule 9. Someone must be able to answer questions about processing. That does not make the formal DPO requirement universal.
If your business may fall into the higher-obligation category, use our Significant Data Fiduciary guide to assess the additional preparation needed.
What penalties can a Data Fiduciary face?
The Act's Schedule sets maximum penalties for different breaches. These include up to ₹250 crore for breach of the security-safeguards obligation, ₹200 crore for breach-notification failures, ₹200 crore for children's-data obligations and ₹150 crore for Significant Data Fiduciary obligations. The residual category for other contraventions carries a ceiling of ₹50 crore.
These are statutory ceilings, not automatic invoices for every affected record. Section 33 requires the Board to consider factors such as the nature, gravity and duration of the breach, the data affected, repetition and mitigation. Avoid multiplying a headline maximum by your customer count to produce a supposed exposure figure.
For planning, identify the underlying control and owner. A security penalty headline becomes more actionable when someone has to check access permissions, processor safeguards and the incident-response contact list.
Frequently asked questions
The main DPDP business duties discussed below are scheduled to commence in May 2027 under the government's commencement notification. Existing sectoral and cybersecurity requirements operate on their own timelines.
What is a Data Fiduciary under the DPDP Act?
A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data, either alone or with others. In everyday terms, it decides why the data is needed and how it will be used. A business collecting customer details for its own orders will generally be the fiduciary for that activity, even if a software provider stores the records.
Sources: DPDP Act, Section 2(i).
Can a company be both a Data Fiduciary and a Data Processor?
A company can be a Data Fiduciary for one activity and a Data Processor for another. A payroll vendor may process a client's employee records on instructions while deciding independently how to use its own recruitment records. Assess the purpose and decisions for each activity. The company name, contract label or choice of software does not settle every role.
Sources: DPDP Act, Sections 2(i) and 2(k).
Does DPDP cover B2B contact details and work email addresses?
B2B contact details can be personal data when they identify an individual, such as a named employee's work email address or direct phone number. The fact that the customer is a company does not create a general B2B exemption. A generic inbox that does not identify a person may be different. Check the Act's scope and any specific exclusion, including the conditions for publicly available data.
Sources: DPDP Act, Sections 2(t) and 3.
Are startups and small businesses exempt from DPDP?
Startup status or a small team does not create a blanket DPDP exemption. A small business can still determine why and how personal data is processed and therefore be a Data Fiduciary. Section 17(3) allows the government to notify exemptions from specified provisions for certain classes of fiduciaries, including startups. Rely on an exemption only after checking the applicable notification and its scope.
Sources: DPDP Act, Sections 2(i) and 17(3).
Does every Data Fiduciary need a Data Protection Officer?
The DPDP Act's formal Data Protection Officer requirement applies to Significant Data Fiduciaries notified under Section 10. It is not a universal requirement for every business. The wider framework still requires a fiduciary to publish the business contact information of its DPO, if applicable, or another person able to answer questions about processing. Assigning that contact does not automatically make the business a Significant Data Fiduciary.
Sources: DPDP Act, Sections 8(9) and 10; DPDP Rules, Rule 9.
Does outsourcing data processing transfer our DPDP responsibility to the vendor?
Outsourcing does not transfer a Data Fiduciary's responsibility for processing performed on its behalf. Section 8(1) places that responsibility with the fiduciary, and Section 8(2) requires a valid contract for the processor engagement it covers. Establish what the vendor may do, how it protects the data and how it assists with incidents and requests. A vendor's compliance claim is not a substitute for checking the actual arrangement.
Sources: DPDP Act, Sections 8(1) and 8(2).
Start with one page of decisions
Create a role register with five fields: processing activity, purpose, deciding entity, processors involved and the evidence supporting that assessment. Test it against three real activities: customer onboarding, employee administration and one vendor integration.
The gaps usually become visible quickly. You may know that your CRM contains customer data but be unable to explain whether its enrichment service uses that data independently. Or you may have a signed contract with no workable route for processor deletion.
Resolve those questions, then connect the register to your data audit and rights-request process. A correct role assessment should change how the business operates, not just how its privacy notice reads.
ComplyZero is a DPDP compliance platform for Indian businesses, built by data protection lawyers and cybersecurity experts. If you want to connect these decisions to owners, controls and evidence, book a DPDP walkthrough.
This article is for informational purposes and reflects the DPDP Act 2023 and DPDP Rules 2025 as understood at the time of writing. For guidance specific to your business, we recommend consulting a qualified data protection professional.
