Data Controller
The GDPR term for the organisation that decides why and how personal data is processed. The DPDP term is Data Fiduciary.
A data controller is the GDPR name for the organisation that decides why and how personal data is used. In India's DPDP Act the same role is called a Data Fiduciary.
Meaning of Data Controller
Many global contracts and tools use GDPR language. When you read "controller", map it to Data Fiduciary, and "processor" to Data Processor.
Under GDPR Article 4(7), a controller is the person or body that, alone or jointly with others, determines the purposes and means of processing personal data. The DPDP Act uses the term Data Fiduciary and defines it in Section 2 in almost the same way: any person who alone or in conjunction with other persons determines the purpose and means of processing personal data. When a contract, vendor form or audit report refers to a controller and you operate in India, read it as Data Fiduciary.
The word fiduciary is not decoration. It signals that the organisation holds the data in a position of trust and bears the principal duties under the Act: giving notice, obtaining valid consent or relying on a legitimate use, maintaining accuracy, applying reasonable security safeguards, reporting breaches, erasing data once the purpose is over, and handling grievances. Under Section 8(1), the fiduciary is responsible for compliance even where processing is carried out by a Data Processor on its behalf, which is the same principle that makes a controller answerable for its processors.
Working out which party is the fiduciary is a question of facts, not labels in a contract. If a company decides what data to collect and what to do with it, it is the fiduciary even if the contract calls it a vendor. If a payroll bureau processes salary data on instructions, it is a processor. A bureau that also uses the same data to build its own marketing database has started to decide purposes and means for itself and risks being a fiduciary for that activity. Joint decision-making is possible too: the Act's wording "in conjunction with other persons" accommodates two organisations that jointly set the purpose and means.
The two regimes diverge in some respects. The DPDP Act adds the Significant Data Fiduciary, a fiduciary notified by the Government on factors such as the volume and sensitivity of the data, risk to Data Principals, and risk to electoral democracy or the security of India, which brings extra duties like a Data Protection Officer based in India, an independent auditor and annual impact assessments. GDPR has no matching tier, although it has its own thresholds for appointing a Data Protection Officer.
Examples of Data Controller
A vendor questionnaire asks "are you a controller or processor?" An Indian SaaS company answers using the Act's terms: fiduciary or processor.
A retailer decides what customer details to collect, sends marketing and chooses a delivery partner. It is the Data Fiduciary, and the courier handling only delivery addresses on its instructions is a Data Processor.
A hospital decides to digitise patient files and uses a cloud vendor to store them. The hospital is the fiduciary and must have a notice, safeguards and a breach plan, while the cloud vendor processes under a contract.
Two companies run a joint loyalty programme and agree on what data to collect and how to use it. Each acts as a fiduciary for the shared programme, so the agreement sets out who issues the notice and handles Data Principal requests.
Why Data Controller matters
Misidentifying your role leads to missed duties. A company that tells its customers it is a mere processor, while in fact deciding what data to gather and how to use it, will not have the notice, consent and breach procedures a fiduciary needs. The cost of that mistake is up to ₹250 crore for failing to maintain reasonable security safeguards and up to ₹200 crore for failing to notify a breach, along with the damage of a public Board order.
Getting the role right also helps you negotiate. Fiduciaries can insist on audit rights, breach-reporting timelines and erasure commitments from their processors, while processors can resist being treated as responsible for choices they do not control.
How it works in practice
- 1For each processing activity, ask: who decided to collect this data, and for what purpose? The answer identifies the fiduciary. Record it in your data inventory.
- 2Where you are the fiduciary, issue a Rule 3 notice, implement consent or the relevant Section 7 use, apply the Rule 6 safeguards, set retention under Section 8(7), publish contact details under Section 8(9), and operate a grievance process.
- 3Translate global paperwork. When a vendor questionnaire or data processing agreement uses "controller", add a line stating that for Indian processing the term means Data Fiduciary under the DPDP Act.
- 4Write processor contracts that set out the instructions, security measures, breach notification time, sub-processor approvals, assistance with Data Principal requests and return or erasure of data at the end.
- 5Review the roles whenever a service changes, such as when a vendor begins to reuse data for its own purposes, because that change can move the vendor into the fiduciary role.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on contract labels. The Act looks at who decides purpose and means. A contract calling you a processor does not change a fiduciary role.
Using GDPR documents unchanged. Add DPDP terms, the Board complaint route and Indian rights to the paperwork.
Forgetting that fiduciaries answer for processors. Section 8(1) keeps responsibility with you.
Ignoring Significant Data Fiduciary status. If the Government notifies you, extra duties apply.
Compliance tips
Add a "role" column to your data inventory with the words fiduciary, processor or joint.
Include in vendor onboarding a short test of whether the vendor will use the data for its own purposes.
Keep sample contract clauses that translate GDPR vocabulary for Indian use.
Revisit roles after mergers or new data-sharing arrangements.
Common questions about Data Controller
Is a data controller the same as a Data Fiduciary?
In practice yes. Both are the organisation that decides why and how personal data is processed. The DPDP Act uses Data Fiduciary and adds the Significant Data Fiduciary category, which has extra duties and has no direct GDPR equivalent.
Can an organisation be both fiduciary and processor?
Yes, for different activities. A company can be a fiduciary for its own customer data and a processor when it handles a client's data on the client's instructions. Roles are assessed activity by activity.
Does the DPDP Act use the word controller anywhere?
No. The Act uses Data Fiduciary and Data Processor. If you see controller in a contract involving Indian data, it should be read as Data Fiduciary, ideally with a clause that says so.
Who is responsible if my processor causes a breach?
As the Data Fiduciary, you are. Section 8(1) makes the fiduciary responsible for compliance even for processing done by a processor on its behalf, and a breach is reported by the fiduciary to the Board and to the affected people.