Glossary
What is a Data Fiduciary under DPDP?
The Data Fiduciary is the organisation that decides why and how personal data is processed. Most duties in the DPDP Act fall on it.
Definition
Under s.2 of the DPDP Act, 2023, a Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. It carries the Act's main obligations in s.8, including responsibility for processing done on its behalf by Data Processors. Core obligations under the DPDP Rules, 2025 begin on 13 May 2027.
What it means
The test is about decisions, not about who holds the data. If your organisation decides why personal data is processed and how, it is the Data Fiduciary for that processing, even when a vendor does the work.
Under s.4, a Data Fiduciary may process personal data only for a lawful purpose, with consent or for a legitimate use. Most duties in the Act and the Rules fall on it.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines the Data Fiduciary |
| s.4 | Process only for a lawful purpose, with consent or for a legitimate use |
| s.5, Rule 3 | Give a notice with every request for consent |
| s.8 | General obligations, including responsibility for processing by its Data Processors |
| s.8(6), Rule 7 | Intimate the Board and each affected Data Principal of a breach |
| s.10, Rule 13 | Extra duties if notified as a Significant Data Fiduciary |
Common misconceptions
- “The vendor that holds the data is responsible for it.” The Data Fiduciary stays responsible for processing done on its behalf by a Data Processor (s.8).
- “Only large companies are Data Fiduciaries.” The definition has no size test. Factors such as data volume and sensitivity come in when the Central Government notifies Significant Data Fiduciaries (s.10).
- “Every Data Fiduciary must appoint a DPO.” Only a Significant Data Fiduciary must (s.10(2)(a)). Every Data Fiduciary publishes a contact for questions about processing (s.8(9), Rule 9).
Related terms
The individual the personal data relates to (s.2).
Data ProcessorProcesses personal data on behalf of a Data Fiduciary (s.2).
Significant Data FiduciaryA Data Fiduciary the Central Government notifies for extra duties (s.10).
Consent ManagerA Board-registered single point of contact for managing consent (s.2, Rule 4).
In TruePrivacy
TruePrivacy is software a Data Fiduciary uses to run its DPDP programme: data discovery, consent records, Data Principal requests, breach management and records of processing. It helps you track the work and keep evidence of it.
Can a company be both a Data Fiduciary and a Data Processor?
Yes, for different processing. It is the Data Fiduciary where it decides the purpose and means, and a Data Processor where it only processes personal data on behalf of another Data Fiduciary.
Who is responsible when a vendor processes data for a Data Fiduciary?
The Data Fiduciary. Under s.8 it is responsible for processing by its Data Processors, and s.8(2) allows a processor to be engaged only under a valid contract.
When do Data Fiduciary obligations start?
Core obligations under the DPDP Rules, 2025, including notice, security safeguards, breach intimation, rights and grievances, begin on 13 May 2027 (Rule 1).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin