Data Fiduciary and Data Processor
In short
A Data Fiduciary is the person who, alone or with others, determines the purpose and means of processing personal data. A Data Processor is the person who processes personal data on behalf of a Data Fiduciary. The individual whose data is processed is the Data Principal.
The obligations under the Act sit on the Data Fiduciary. Engaging a Data Processor does not transfer them. Section 8(1) is explicit that a Data Fiduciary is responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor.
01Terminology, and why it matters
| Concept | India, DPDP | EU, GDPR | Saudi Arabia, PDPL |
|---|---|---|---|
| Determines purpose and means | Data Fiduciary | Controller | Controller |
| Processes on instruction | Data Processor | Processor | Processor |
| The individual | Data Principal | Data Subject | Data Subject |
| Regulator | Data Protection Board of India | The relevant supervisory authority | SDAIA |
There is no controller under Indian law. A policy, a contract or a notice that uses controller and data subject in an Indian context has been ported from a GDPR template, and the drafting error is usually the visible end of a scoping error underneath it.
02What follows from the classification
- Notice and consent. The Section 5 notice and the Section 6 consent are the Data Fiduciary's, and Rule 3 sets what the notice must contain.
- Security safeguards. Rule 6 obliges the Data Fiduciary to protect personal data in its possession or under its control, including where processing is done on its behalf by a Data Processor, and requires appropriate contractual provision with that processor for taking reasonable security safeguards.
- Breach intimation. Rule 7 places the intimation obligations on the Data Fiduciary. Nothing in it is contingent on when the processor reported.
- Retention and logs. Rule 8(3) requires personal data, associated traffic data and logs to be retained for at least one year from the date of processing, in respect of processing undertaken by the Data Fiduciary or on its behalf by a Data Processor.
- Data Principal rights. Requests are made to the Data Fiduciary. A processor has no standing to answer them.
The illustration in Rule 8 makes the point directly: where a company engages a cloud service provider as its Data Processor to host customer records, the company as Data Fiduciary is required to ensure that the provider also retains the data and associated logs for at least one year before erasure.
03Where the boundary is drawn wrongly
Three patterns account for most of the errors.
- The vendor that decides. A service provider that determines its own purposes for the data, for example using client data to improve or train its own products, is acting as a Data Fiduciary for that processing regardless of what the contract calls it.
- The group entity. A captive or global capability centre processing on instruction from a parent may be a Data Processor for that work and a Data Fiduciary for its own employee data at the same time. Both roles run in parallel.
- The platform partner. Where two entities each determine part of the purpose, for example a lender and a loan service provider, they may each be a Data Fiduciary for their own processing. Calling one of them a processor in the contract does not settle it.
Resolve this before scoping any compliance programme. It determines which obligations apply, which determines what has to be built, which determines what it costs.
04Common questions
Does the DPDP Act place obligations directly on a Data Processor?
The Act's obligations run to the Data Fiduciary, which must in turn engage a Data Processor only under a valid contract and must secure processing carried out on its behalf. Processors are principally bound through that contract.
Can one organisation be both?
Yes, for different processing activities. The classification is per processing purpose, not per company.
Is a Data Fiduciary the same as a controller?
The concepts are close but the terms are not interchangeable, and controller has no meaning under Indian law. Use Data Fiduciary in Indian documents.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.