Data Fiduciary
A person or organisation that, alone or with others, decides why and how personal data is processed.
A Data Fiduciary is whoever decides why and how personal data is used. It is the party that carries most of the DPDP Act's duties.
Meaning of Data Fiduciary
The label depends on the role played, not the type of entity. A company, a hospital, a school, a government department, a start-up and an individual professional can all be Data Fiduciaries. Most of the Act's duties fall on the Data Fiduciary, including notice, consent, security, breach reporting and handling rights requests.
Section 2(i) defines a Data Fiduciary as any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. "Person" in Section 2(s) includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and any artificial juristic person. So a start-up, a hospital, a school, a municipal body and a sole-proprietor chartered accountant can all be fiduciaries.
The label follows control, not paperwork. If your team chooses which data to collect, for what reason and how long to keep it, you are the Data Fiduciary, whatever the contract says. If you only act on another organisation's instructions, you are a Data Processor. Two organisations can also be joint fiduciaries when they decide purposes together, such as a bank and a co-branding partner running a shared rewards programme.
The word "fiduciary" signals trust. Data Principals hand over information on the understanding that it will be used for the stated purpose only, and the Act expects the organisation to act in that spirit. Obligations include notice (Section 5), valid consent or a legitimate use (Sections 4, 6, 7), accuracy (Section 8(3)), security safeguards (Section 8(5)), breach intimation (Section 8(6)), erasure (Section 8(7)), published contact details (Section 8(9)) and a grievance mechanism (Section 8(10)).
Under Section 8(1) the fiduciary remains responsible even when processing is outsourced, and regardless of any agreement or the Data Principal's lapses. Under GDPR the equivalent role is the controller, but some mechanics differ: the DPDP Act has no "legitimate interest" ground, and Significant Data Fiduciaries bear additional duties under Section 10 once the Central Government notifies them.
Examples of Data Fiduciary
An e-commerce company deciding what customer data to collect and how to use it for deliveries and marketing is a Data Fiduciary.
A lending app decides which user data to collect for credit assessment and how to use it. It is the Data Fiduciary. The cloud host and the SMS gateway it uses are processors, bound by contract. The app answers rights requests itself, while keeping RBI rules in mind.
A hospital decides what patient data to record and why. It is a Data Fiduciary for the patient file. A diagnostic imaging vendor storing scans on the hospital's behalf is a processor. When a patient asks for correction of an address, the hospital handles it.
A retailer and an airline run a joint loyalty card and decide the purposes together. They treat themselves as joint fiduciaries, agree who sends the notice and who handles requests, and tell customers in a single notice.
Why Data Fiduciary matters
Status as a Data Fiduciary exposes an organisation to inquiry by the Data Protection Board and to penalties under Section 33 and the Schedule. The Schedule lists up to ₹250 crore for failing reasonable security safeguards, up to ₹200 crore for failing to notify a breach to the Board or Data Principals, up to ₹200 crore for breaching children's obligations and up to ₹50 crore for other breaches. Repeated penalties can lead the Board to refer the matter to the Central Government for blocking under Section 37.
There is a commercial side too. Enterprise customers, banks and regulators will ask vendors to confirm their status and controls before signing. A clear statement of roles, backed by documents, speeds up procurement and builds trust with customers.
How it works in practice
- 1Decide your role for each processing activity in writing. Record whether you act as a fiduciary, a joint fiduciary or a processor, and note the reasoning.
- 2Prepare the core set of artefacts: privacy notice, consent records, retention schedule, security policy, breach response plan, rights request procedure and grievance route.
- 3Appoint a privacy lead and publish contact details as required by Section 8(9) and Rule 9, even if you are not a Significant Data Fiduciary.
- 4Put written contracts in place with every processor, covering instructions, security, sub-processing, breach cooperation and erasure at the end of the contract.
- 5Review and test your controls on a calendar, since the main Chapter II obligations are scheduled to apply from 13 May 2027 and preparation takes months.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing only large companies are Data Fiduciaries. Any person who decides purpose and means qualifies, from a one-person clinic to a ministry.
Blaming the vendor after a leak. Section 8(1) keeps responsibility with the fiduciary, so choose processors carefully and audit them.
Assuming a signed contract fixes the role. The label turns on who actually decides purposes and means.
Relying on GDPR-style "legitimate interest" to justify marketing. The DPDP Act has no such ground, so use consent or a listed legitimate use.
Compliance tips
Keep a role register with each system, its purpose, and whether you or a partner decides it.
Include audit and breach-cooperation clauses in processor contracts, and check that sub-processors are disclosed.
Match your published notices to what you actually do. Notices that promise more than the practice are a common weakness.
Hold a short quarterly review with business, IT and legal to catch new uses of data before they launch.
Common questions about Data Fiduciary
Who is a Data Fiduciary under the DPDP Act?
Any person who alone or with others decides why and how personal data is processed. It can be a company, a start-up, a hospital, a school, a government department or an individual professional. Role depends on control over purpose and means.
Is a Data Fiduciary the same as a data controller?
They are broadly equivalent. Controller is the GDPR term. The Indian Act uses Data Fiduciary, which carries a flavour of trust, and has different grounds for processing and its own penalty structure.
Can a processor also be a fiduciary?
Yes, for different activities. If a processor starts deciding its own purposes for the data, for example using it to train its own product, it becomes a fiduciary for that use and must meet the Act's duties directly.
Do small businesses count as Data Fiduciaries?
Yes. Size does not matter for the definition. Section 17(3) lets the Central Government notify classes such as start-ups for relief from some obligations, but that depends on a notification and should be checked.