DPDP roles
Your role follows the purpose, not the heading on the contract.
The Act puts almost every duty on the data fiduciary. Working out your role for each activity tells you which duties are yours, which you pass to vendors by contract, and which your customers will expect you to carry for them. Most companies hold more than one role at once.
Back to DPDP services01 · The roles
The roles the Act names
Around the individual, the data principal, sit five kinds of actor.
- Data fiduciary
- Decides the purpose and means of processing. Carries the duties and the penalty exposure.
- Joint fiduciaries
- Two or more parties deciding purpose and means together. The definition covers anyone who decides 'alone or in conjunction with' others, so each is a fiduciary in its own right.
- Data processor
- Processes on behalf of a fiduciary. The Act addresses its duties to the fiduciary, so a processor's obligations reach it mainly through the contract.
- Consent manager
- A company registered with the Board that lets people give, manage, review and withdraw consent across fiduciaries. It acts for the individual, not for you.
- Significant data fiduciary
- A fiduciary the Government notifies for extra duties, based on factors such as volume, sensitivity and risk. It has its own guide.
The words differ from other privacy laws, and so do some of the consequences. The GDPR and DPDP guide covers the comparison; this page stays with the Act.
02 · The test
Four questions that settle your role
Ask them per activity, never once for the whole company.
- Whose purpose is it? If the reason for processing is your own (your product, your marketing, your hiring), you are the fiduciary for it.
- Who chose the essential means? Deciding which data to collect, how long to keep it and who may see it points to a fiduciary. Choosing a database engine does not.
- Can you use the data for anything of your own? If the contract allows it and you do it, you are a fiduciary for that use.
- Whose relationship is it? The party the person signs up with, buys from or works for is usually the fiduciary.
A contract label is evidence, not proof
Calling a vendor a 'processor' does not make it one if it reuses data for its own ends. An inquiry would look at what actually happens to the data.
03 · Decision table
A decision table for common situations
Most businesses are both fiduciary and processor, for different data.
| Situation | Usual role | Why |
|---|---|---|
| Your own customer, staff and marketing data | Data fiduciary | You decide why and how it is processed |
| A cloud host running your database | Data processor for you | It runs infrastructure on your instructions |
| A payroll provider paying your staff | Usually a data processor | It works to your instructions; check whether it reuses data for its own products |
| A software vendor training its own models on customer data | Data fiduciary for that use | The training purpose is the vendor's own |
| Two firms running a co-branded loyalty scheme on one member list | Joint fiduciaries | Both set the purpose and the data collected |
| A lender receiving a borrower's bank statement through a consent manager | The lender is a data fiduciary | The consent manager carries consent; it is not the lender's processor |
| An Indian outsourcer serving a foreign client's overseas customers | Usually a processor; most duties exempted by section 17(1)(d) | The people are outside India and the contract is with a foreign party |
| A person keeping contacts on a personal phone | Outside the Act | Personal or domestic purpose |
Illustrative positions only. The facts of each arrangement decide the answer.
04 · A B2B example
Illustrative: one HR software company, three roles
How a single business moves between roles in the same week.
Illustrative, not a client. Company H, a Bengaluru business, sells a cloud HR system to Indian employers. Follow its activities and its role changes with each one.
| Activity | Company H's role | Fiduciary | What follows |
|---|---|---|---|
| Hosting an employer's staff records | Data processor | The employer | Works under the employer's contract and erases when told |
| Sending payslips through an email service | Processor, using a sub-processor | The employer | The employer's terms must flow down to the email service |
| Emailing HR heads at prospects about its product | Data fiduciary | Company H | Needs its own ground, notice where consent is used, and an easy opt-out |
| Running payroll for its own staff | Data fiduciary | Company H | Employment is a legitimate use; security and erasure still apply |
| Building a salary benchmark from all customers' payroll data | Data fiduciary for this new purpose | Company H | Needs a lawful ground of its own; without one, this is the exposure |
The last row is where vendor roles most often shift without anyone writing it down.
05 · When roles shift
Signals that a role has changed
Watch the purpose, the contract and the data flows.
- A new internal useProduct or analytics teams start using customer data for a purpose the customer never set.
- Loose contract wordingTerms that allow 'service improvement' or 'aggregated insights' can make a processor a fiduciary for that use.
- New sub-processorsEach one extends your chain. The fiduciary stays answerable for all of it.
- Data passed to a partnerIf the partner decides how to use it, the partner is a fiduciary, and the transfer needs a ground.
- Mergers and acquisitionsA combined customer base changes who decides what, and when.
06 · What to put in writing
What each side should put in writing
Section 8(2) requires a valid contract before a processor works on your data.
If you are the fiduciary
- Purpose and instructions for each processing activity
- Security safeguards the processor must keep, which rule 6 expects the contract to cover
- Breach reporting to you fast enough to meet your own duty
- Erasure on your instruction and when the purpose ends
- Retention of data and processing logs for the minimum period the Rules set
- Approval of sub-processors, with terms flowing down
- Help with rights requests and withdrawals
If you are the processor
- A clear statement of what you may and may not do with the data
- No use for your own purposes unless agreed and lawful
- A named breach-notice route and contact
- A method to evidence deletion
- A current sub-processor list your customers can see
Sources: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), sections 2, 6, 8, 10 and 17; the Digital Personal Data Protection Rules, 2025, rules 4, 6 and 8.
Questions about roles
Can we be a fiduciary and a processor at the same time?
Yes, for different activities.
Roles attach to activities, not companies. A software vendor is usually a processor for the data it hosts for customers and a fiduciary for its own staff, sales and product analytics.
Does a processor have duties under the Act?
Mostly through the contract and the fiduciary's instructions.
The Act addresses its obligations to the fiduciary, which stays responsible for processing done for it, whatever the agreement says. It must make processors stop processing on withdrawal and erase data. In practice a processor's duties arrive through contracts and customer reviews.
Is a consent manager our processor?
No. It acts for the individual.
A consent manager is accountable to the data principal and acts on her behalf. Your notice, your purposes and your other duties stay with you.
How do we know if we are a significant data fiduciary?
Only a Government notification makes you one.
The Government notifies a fiduciary or a class of fiduciaries after weighing factors such as volume and sensitivity of data and risk to people's rights. Watch for notifications that name your sector.
Does a foreign fiduciary need a representative in India?
The Act does not ask for one in general.
There is no general local-representative duty. A significant data fiduciary, however, must appoint a Data Protection Officer based in India.
Map your roles before you rewrite contracts.
A DPDP readiness assessment settles your role per activity and lists the contract changes that follow. Counsel should confirm how the law applies to your contracts.