Under India's DPDP Act, the data fiduciary carries the duty, whoever does the work.

Every time personal data is used, someone chose the purpose and the method. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), that someone is the data fiduciary. The word fiduciary is deliberate: it signals a position of trust towards the people whose data it holds.

The Act hangs almost every obligation on this role: notice, valid consent, accuracy, reasonable security safeguards, breach intimation, erasure, a published contact for questions and a working grievance process. Section 8 makes the fiduciary responsible even for processing a vendor does on its behalf, and even if a contract says otherwise. So the first question in any DPDP programme is which of your activities make you a fiduciary. Get that wrong and every later control is pointed at the wrong owner. The penalty Schedule sets its highest ceiling, up to 250 crore rupees, for a fiduciary that fails to keep reasonable security safeguards.

Your privacy notice

The notice is issued in the fiduciary's name, because it is the party asking for consent and stating the purpose.

Vendor and customer contracts

Clauses that say who decides the purpose, and therefore who is the fiduciary and who is the processor.

The processing record

Each activity in the data map should name the fiduciary that owns it, especially where two companies share a dataset.

A breach response meeting

The fiduciary must tell the Data Protection Board of India (the Board) and each affected person, so it chairs the decisions.

Data controller

The GDPR's word for the same idea. The tests are close, but the duties attached differ, so do not copy a GDPR role map across without checking.

Significant data fiduciary

A fiduciary the Central Government notifies for extra duties. Every significant data fiduciary is a fiduciary; most fiduciaries are not significant.

Data processor

Acts only on a fiduciary's behalf. If a vendor starts choosing its own purposes for the data, it has become a fiduciary for that use.

• List each processing activity and write down who chose its purpose and its means.
• Where a partner also decides purposes, record that you are both fiduciaries and split the notices and duties in writing.
• Put a valid contract in place with every processor, because the Act only lets you use one under a contract.
• Publish the business contact of the person who answers questions about your processing.

• GuideData fiduciary, processor or consent manager?The three roles the Act names, and which one you are.
• GuideWhat a data fiduciary must doThe duties, from notice to security to erasure.
• GuideGDPR and India's DPDP ActData fiduciaries, consent, rights and penalties, side by side with GDPR.

Sources: Digital Personal Data Protection Act, 2023, sections 2, 8 and 10 and the Schedule; Digital Personal Data Protection Rules, 2025, rules 6, 7 and 9. Not legal advice.