A Data Fiduciary decides the purpose and means of processing personal data, alone or with others (section 2(i)). A Data Processor processes it on a fiduciary's behalf (section 2(k)). The fiduciary carries the Act's obligations, stays responsible for its processors despite any contrary agreement (section 8(1)), and may use a processor only under a valid contract (section 8(2)).
Key takeaways
- The test is who decides why and how data is processed, not who holds it or who is bigger.
- One company can be a fiduciary for some data flows and a processor for others. Map roles per flow.
- Under section 8(1), the fiduciary is responsible for its processors' processing, whatever the contract says.
- Processors must be engaged under a valid contract (section 8(2)) that carries Rule 6 safeguards.
- Keep a current list of processors: the right of access under section 11 includes their identities.
Every DPDP programme starts with one question: for this data, are we deciding what happens to it, or acting on someone else's instructions? The answer decides who must give notice, collect consent, report breaches and answer rights requests. Get it wrong and you either build controls you do not need or leave obligations with nobody.
The Act uses its own terms. The individual is the Data Principal, the organisation in charge is the Data Fiduciary, and the service provider is the Data Processor. This guide explains each, works through common examples, and sets out how to map roles across your business.
What is a data fiduciary?
Section 2(i) defines a Data Fiduciary as any person who "alone or in conjunction with other persons" determines the purpose and means of processing personal data. Purpose is the why: delivering an order, running payroll, sending marketing. Means is the how, at least in the essentials: which data, for how long, shared with whom.
The Data Principal is the individual the data relates to (section 2(j)). For a child, that includes the parents or lawful guardian; for a person with disability, the lawful guardian acting on her behalf. Two other actors complete the picture: consent managers, registered with the Board to help people give and withdraw consent, and the Data Protection Board itself.
What is a data processor under DPDP?
Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. A processor does not choose the purpose. It follows the fiduciary's instructions, even if it has a great deal of technical freedom in how it delivers its service.
Most obligations in the Act are written for the fiduciary. Processors are brought in through the fiduciary: a valid contract under section 8(2), safeguards written into that contract under Rule 6(f), and the fiduciary's duty to make its processors stop processing when consent is withdrawn (section 6(6)) and erase data when required (section 8(7)).
Data Fiduciary
- Decides purpose and essential means
- Needs consent or a section 7 legitimate use
- Gives notice (section 5, Rule 3)
- Reports breaches to the Board and every affected person
- Answers rights requests and grievances
- Responsible for its processors (section 8(1))
Data Processor
- Processes on the fiduciary's behalf
- Works under a valid contract (section 8(2))
- Applies the safeguards in that contract
- Tells the fiduciary about breaches quickly
- Stops processing and erases on instruction
- Becomes a fiduciary if it uses data for its own purposes
Data fiduciary examples: who is what?
Roles attach to data flows, not to companies. The same organisation often holds both roles. These are typical outcomes; check each flow against the facts of your arrangement.
| Organisation | Data flow | Usual role | Why |
|---|---|---|---|
| B2B SaaS (for example, HR software) | Records customers upload into the product | Processor | The customer decides what to store and why |
| B2B SaaS | Customer admin accounts, billing, product analytics, marketing | Fiduciary | The SaaS company decides these purposes |
| Payroll provider | Running payroll on the employer's instructions | Processor | The employer sets the purpose |
| Payroll provider | Using salary data to offer its own products to employees | Fiduciary | A new purpose of its own; needs its own ground |
| Cloud host | Customer workloads and storage | Processor | Hosts on instruction, no purpose of its own |
| Payment gateway | Processing a payment for a merchant | Depends on the flow | Some processing is for the merchant; fraud and regulatory checks it runs under its own obligations point to a fiduciary role for those purposes |
| Marketing agency | Running a campaign on a brand's list, to its brief | Processor | The brand decides audience and purpose |
| Marketing agency | Building its own audience pool from client campaigns | Fiduciary | It decides a purpose of its own |
| Call centre | Handling a brand's customer calls to its script | Processor | Acts for the brand |
| Any employer | Employee and candidate records | Fiduciary | Decides HR purposes; section 7(i) covers employment uses |
Payment and lending flows deserve extra care because sector rules, such as RBI payment data storage requirements, apply alongside DPDP. The fintech guide covers those. For software companies, the DPDP for SaaS guide goes deeper on the split.
Why section 8(1) makes the fiduciary accountable
Section 8(1) says the fiduciary is responsible for complying with the Act and Rules for any processing "undertaken by it or on its behalf by a Data Processor", irrespective of any agreement to the contrary. Section 8(5) repeats the point for security: the fiduciary must protect personal data in its possession or under its control, including processing done by a processor.
In practice this means:
- A breach at your processor is your breach for section 8(6) breach intimation. You must tell the Board and every affected Data Principal, and file the detailed report within 72 hours of becoming aware (Rule 7).
- Penalties under the Schedule fall on the fiduciary: up to ₹250 crore for failing to take reasonable security safeguards. A contract cannot move that exposure, though it can allocate commercial liability between the parties.
- When someone withdraws consent, you must make your processors stop processing within a reasonable time.
- Rule 8(3) requires you to retain processing logs, including your processors', for at least one year.
When are two companies joint fiduciaries?
The definition covers determining purpose and means "alone or in conjunction with other persons". Where two organisations decide together why and how data is processed, both are fiduciaries for that flow. Common cases include co-branded credit cards or loyalty programmes, platform and partner arrangements where both use the data for their own purposes, and group companies sharing a customer database.
Each fiduciary owes the obligations for its own processing. To avoid gaps or double work, agree in writing who gives the notice, who records consent, who handles rights requests and grievances, and how breaches are reported between you. Section 8(3) also applies when you disclose data to another fiduciary: you must ensure it is complete, accurate and consistent.
What should a DPDP data processing agreement contain?
Section 8(2) allows a fiduciary to "engage, appoint, use or otherwise involve" a processor only under a valid contract. The Act does not prescribe clauses, but the obligations you carry for processors tell you what the contract must cover.
| Clause | What it should say | Ties to |
|---|---|---|
| Instructions | Process only for the documented purposes and on your instructions | s.2(k), s.8(1) |
| Security safeguards | Encryption, access control, logging, backups and testing to a stated standard | s.8(5), Rule 6(f) |
| Breach notice | Notify you within hours, with the facts Rule 7 asks for | s.8(6), Rule 7 |
| Withdrawal | Stop processing for a purpose when you say consent is withdrawn | s.6(6) |
| Erasure | Erase on instruction and at contract end, with confirmation | s.8(7) |
| Log retention | Keep processing logs for at least one year and share them on request | Rule 6(e), Rule 8(3) |
| Rights support | Help you answer access, correction and erasure requests within your timelines | s.11 to 13 |
| Sub-processors | Prior approval, a published list, and the same terms flowed down | s.8(1), s.8(2) |
| Location and transfers | Where data is stored and processed; compliance with sector rules | s.16 |
| Audit and evidence | Reports, certifications and audit rights you can rely on | s.8(4) |
Set the breach notice period with your own 72-hour deadline in mind. If a processor can take three days to tell you, you will miss the Board's timeline.
How should you handle sub-processors?
A processor often uses its own processors: a SaaS vendor's cloud host, email provider or support tool. The Act does not use the word sub-processor, but section 8(1) still makes you responsible for processing done on your behalf, however far down the chain it happens.
- Ask for the list. Every processor should publish or share its sub-processors, with locations.
- Require notice of changes and a right to object.
- Flow down the same terms, especially safeguards, breach notice and erasure.
- Keep your own register current. Under section 11, a Data Principal can ask for the identities of fiduciaries and processors her data was shared with. You cannot answer without a register.
How to run a role-mapping exercise
Role mapping is a short, structured workshop, not a legal memo. Run it with product, engineering and legal in the room, using your data inventory as the input.
Data, source, system, purpose
Purpose test
Essential means test
Role and reasoning
Notices, contracts, review
Watch for flows where a processor starts using data for its own purposes, such as product improvement across all customers or building benchmarks. That use makes it a fiduciary for that purpose, with its own need for consent or a legitimate use. Our reference case study shows how an illustrative payroll SaaS split 31 purposes between the two roles.
What to do next
- Build or refresh your data inventory, then run the role-mapping workshop.
- For fiduciary flows, confirm the lawful ground: see consent and legitimate uses.
- For processor flows, update your customer contracts and give customers the controls they need.
- Put a valid contract in place with every processor you use, with the clauses above.
- Add role mapping to the compliance checklist and repeat it for every new product or vendor.
If you want help running the mapping and turning it into contracts and controls, talk to our implementation team.
Frequently asked questions
What is the meaning of data fiduciary under the DPDP Act?
Section 2(i) defines a Data Fiduciary as any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data. "Person" includes companies, firms, individuals and the State. It is close to a GDPR controller.
What is a data fiduciary example?
An e-commerce company collecting customer addresses to deliver orders, an employer processing payroll data for its staff, and a bank processing account holders' data are all Data Fiduciaries for those purposes, because each decides why and how the data is used.
Who is a data principal?
The individual to whom the personal data relates (section 2(j)). For a child, the term includes the parents or lawful guardian. For a person with disability, it includes the lawful guardian acting on her behalf.
Does the DPDP Act apply to data processors?
Most obligations are addressed to the fiduciary, which is responsible for processing done on its behalf (section 8(1)). Processors are reached through contracts the fiduciary must have under section 8(2), with security safeguards required by Rule 6(f), and through the fiduciary's duty to make processors stop processing and erase data.
Can a company be both a data fiduciary and a data processor?
Yes, and many are. A B2B SaaS company is usually a processor for the data its customers put into the product, and a fiduciary for its own customer accounts, billing, marketing and staff. The role is decided flow by flow.
Is a cloud provider a data fiduciary or a data processor?
For customer workloads it hosts on instruction, a cloud provider usually acts as a processor. For its own account holders' data, billing and support, it is a fiduciary. If it used customer data for its own purposes, it would become a fiduciary for that use.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.