Glossary
What is a Data Processor under DPDP?
A Data Processor works on personal data for someone else. The Data Fiduciary that engages it stays responsible for what it does.
Definition
Under s.2 of the DPDP Act, 2023, a Data Processor is any person who processes personal data on behalf of a Data Fiduciary. The Data Fiduciary stays responsible for that processing (s.8) and may engage a Data Processor only under a valid contract (s.8(2)). Rule 6 lists security terms in contracts with Data Processors among the minimum safeguards.
What it means
Hosting providers, payroll services, support desks and analytics vendors are typical Data Processors when they process personal data only on your instructions. If a vendor starts deciding the purpose and means for itself, it becomes a Data Fiduciary for that processing.
The Act puts the duties on the Data Fiduciary, which must make its processors follow them. That is why processor contracts and vendor due diligence matter.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines the Data Processor |
| s.8 | The Data Fiduciary is responsible for processing by its Data Processors |
| s.8(2) | A Data Processor is engaged only under a valid contract |
| s.6(6) | After consent is withdrawn, processors must stop processing within a reasonable time |
| s.8(7) | The Data Fiduciary must make its processors erase personal data |
| Rule 6 | Security terms in contracts with Data Processors |
Common misconceptions
- “Hiring a processor moves the responsibility.” It does not. The Data Fiduciary stays responsible under s.8.
- “Security is the vendor's problem.” Rule 6 lists security terms in contracts with Data Processors among the safeguards the Data Fiduciary must take.
- “Erasure stops at our own systems.” s.8(7) requires the Data Fiduciary to make its processors erase too.
Related terms
Decides the purpose and means of processing personal data (s.2).
ProcessingAny wholly or partly automated operation on digital personal data (s.2).
ErasureDeleting personal data on request or when the purpose ends (s.8(7), s.12).
Cross-border transferTransfer of personal data outside India (s.16, Rule 15).
In TruePrivacy
Vendors and processors keeps vendor records with risk levels, sends assessments through a vendor portal link and tracks contracts (DPAs). Its question templates include one asking processors to report breaches without delay.
Does a Data Fiduciary need a contract with each Data Processor?
Yes. s.8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Rule 6 lists security terms in contracts with Data Processors among the minimum safeguards.
Who answers to the Data Principal when a processor makes a mistake?
The Data Fiduciary. s.8 makes it responsible for processing done on its behalf by a Data Processor.
Must processors stop when consent is withdrawn?
Yes. The Data Fiduciary must have its processors stop processing within a reasonable time after withdrawal (s.6(6)), and make them erase personal data when s.8(7) applies.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin