Two laws use the same word, and both mean a party acting on another's instructions.

A data processor does the work but not the deciding. A payroll bureau, a cloud host or a support outsourcer handles personal data because a client asked it to. Both India's DPDP Act and the EU General Data Protection Regulation (GDPR) use the word, but they load it very differently.

Under the DPDP Act, the processor carries almost no direct statutory duties. The data fiduciary stays answerable for what its processor does, may only use one under a valid contract, must make it keep reasonable security safeguards and must have it erase data when the purpose ends. The Rules add that the fiduciary should keep logs, including the processor's, for at least a year. Under the GDPR the processor has its own duties: Article 28 lists what the contract must contain, and processors must keep records, secure the data, use sub-processors only with authorisation and tell the controller about breaches without undue delay. An Indian vendor serving both markets needs both views.

A data processing agreement

The contract that fixes instructions, security, sub-processors, breach notice and return or deletion of data.

A customer security review

Questionnaires asking which sub-processors you use and how you would support the client's own duties.

The sub-processor list

A published list a GDPR controller can object to, and a DPDP fiduciary will ask about.

A SOC 2 or ISO 27001 scope

Assurance reports a processor shares to show its safeguards, which the client relies on.

Sub-processor

A vendor your processor hires. Under the GDPR it needs the controller's authorisation; under the DPDP Act the fiduciary's contract should govern it.

Data fiduciary or controller

The party that decides why. A processor that starts using data for its own ends becomes a fiduciary or controller for that use.

• Write down, client by client, whose instructions you follow and whether you ever use the data for yourself.
• Keep one processing agreement that meets GDPR Article 28 and the DPDP contract and erasure needs.
• Maintain a current sub-processor list and a way to tell clients when it changes.
• Agree breach notice timings with each client so they can meet their own clocks.

• GuideDPDP for SaaS and IT service providersProcessor contracts, client reviews and shared duties.
• GuideControllers, processors & DPOsWho decides, who processes, and when a DPO is required.
• GuideData fiduciary, processor or consent manager?The three roles the Act names, and which one you are.

Sources: Digital Personal Data Protection Act, 2023, sections 2, 8 and 17; Digital Personal Data Protection Rules, 2025, rules 6 and 8; Regulation (EU) 2016/679, Articles 4, 28, 30, 32 and 33. Not legal advice.