Under India's Digital Personal Data Protection (DPDP) Act, 2023, every organization that handles personal data falls into one of two roles: data fiduciary or data processor.
A data fiduciary decides why and how personal data is processed.
A data processor carries out those instructions on the fiduciary's behalf, with no independent decision-making authority.
The distinction matters because the DPDP Act ties accountability, liability, and contractual duty directly to which role you occupy. A data fiduciary answers to the regulator and to the people whose data it holds. A data processor, for the most part, answers only to the fiduciary that hired it.
Note: The same organization can hold both roles at once, acting as a fiduciary for its own employee or customer data while serving as a processor for a client's data under a separate engagement.
This article walks through both roles, how liability splits between them, and why the contract sitting between a fiduciary and its processor is doing more legal work than most businesses realize.
Data Fiduciary and Data Processor: What Each Role Means
Data Fiduciary
As per Section 2(i) of the DPDP Act:
A data fiduciary is any person who, alone or in conjunction with others, determines the purpose and means of processing personal data.
In plain terms, the fiduciary makes the decisions. It determines why the data is being collected and how it will be used. When someone signs up for a bank account, a shopping app, or a hospital's patient portal, that organization is the data fiduciary for the information it collects.
Data Processor
As per Section 2(k) of the DPDP Act:
A data processor is any person who processes personal data on behalf of a data fiduciary.
The processor doesn't decide anything about why or how personal data is processed. It follows instructions. The payroll vendor a company hires, the cloud hosting provider, the email platform, the analytics tool - these are typically processors, doing work on behalf of the organization that made the underlying decisions.
The Data Principal
There's also an important third party worth naming: the data principal, the individual whose personal data is being processed. The fiduciary answers to the data principal directly. The processor, in most setups, never has a direct relationship with that individual at all.
How to Determine Whether You're a Fiduciary or a Processor
The Control Test
Everything comes down to one question: who decides the purpose and means of the processing? If your organization sets the why and the how, you're a fiduciary. If you only execute what someone else decided, you're a processor. Regardless of company size or industry, it's purely a question of control.
For example, the fiduciary decides that customer data will be used for credit scoring, and how long it will be retained. The processor runs the servers or software that makes it happen, with no say in the plan itself.
The One-Line Version
- If you decide why and how personal data is used, you're a fiduciary. If you're executing someone else's instructions, you're a processor.
Data Fiduciary vs. Data Processor: Key Differences
| Criteria | Data Fiduciary | Data Processor |
|---|---|---|
| Decision-Making Authority | Decides the purpose and means of processing. | Has no independent decision-making power and follows documented instructions from the fiduciary. |
| Relationship With the Data Principal | Holds the relationship with the data principal and is responsible for data collection under the DPDP Act, including issuing consent and notice before collection. | In most cases, processor has no direct relationship with the individual. |
| Legal Liability | Responsible for processing carried out by it or on its behalf, including processing performed by a data processor as per Section 8 of the DPDP Act. | Carries very little direct statutory liability under the Act itself. |
| Breach Response Obligations | Responsible for breach notification under the DPDP Act and must notify the Data Protection Board and affected individuals within the prescribed timelines. | Reports breaches to the fiduciary according to the timeline specified in the contract, rather than directly to the regulator. |
| Statutory Obligations | Has extensive obligations, including obtaining valid consent, providing clear notice, honoring data principal rights, implementing security safeguards, ensuring timely data deletion, and appointing a grievance officer. | Duties primarily arise from its contract with the fiduciary and the security requirements attached to that relationship. |
| Penalty Exposure | Remains exposed to penalties of up to ₹250 crore under the DPDP Act, for failure to take reasonable security safeguards to prevent a personal data breach, even when the incident occurs within a processor's environment. | May be subject to contractual consequences, including indemnity obligations, where its failure causes a loss. |
| Can the Role Change? | A party can become a fiduciary when it begins deciding the purpose or means of processing, taking on the obligations that come with that role. | A processor that starts deciding the purpose or means of processing stops being a processor and becomes a fiduciary. The same company can also act as a fiduciary in one relationship and a processor in another. |
Why a Data Processing Agreement Is Mandatory Under the DPDP Act
Under the DPDP Act 2023, a fiduciary can only bring in a processor through a valid contract. That contract, the data processing agreement (DPA), anchors the entire relationship legally. Without it, the arrangement doesn't meet the Act's requirements, and if a breach occurs, the fiduciary carries the full penalty with no contractual basis to recover anything from the vendor.
A generic master service agreement won't hold up here. A proper DPA needs to cover:
- The precise purpose and scope of processing, along with the categories of data involved.
- Confirmation that the processor acts only on the fiduciary's documented instructions.
- The specific security safeguards the processor is required to maintain.
- The timeline and process for the processor to report breaches to the fiduciary.
- Support for handling data principal rights requests.
- Terms governing sub-processing, including any prior-approval requirements.
- What happens to the data — return or deletion — once processing ends.
- Indemnity terms, so the fiduciary can recover losses if the processor's failure caused them.
The bottom line: The regulator holds the fiduciary accountable, not the vendor. A data principal's grievance goes to the fiduciary, not the vendor. The DPA is what lets the fiduciary shift that exposure back onto the processor when it's warranted. Without it, the fiduciary carries the entire risk on its own.
When a Data Fiduciary Becomes a Significant Data Fiduciary
Not every fiduciary carries the same weight. The Act creates a heavier category: the Significant Data Fiduciary (SDF), for entities whose processing carries higher risk, based on factors like the volume and sensitivity of data they handle. Organizations designated as an SDF take on additional duties:
- Appoint a Data Protection Officer based in India.
- Conduct periodic Data Protection Impact Assessments (DPIAs).
- Carry out independent data audits
Processors have no equivalent tier under the Act. It's another reminder that the framework's heavier obligations sit squarely on the fiduciary side of the line, which is worth factoring into how your organization structures its data privacy compliance program and consent workflows.
Frequently Asked Questions
What is the difference between a data fiduciary and a data processor?
A data fiduciary decides the purpose and means of processing personal data and carries primary liability under the DPDP Act. A data processor processes data only on the fiduciary's instructions and carries limited direct statutory liability, with most of its obligations flowing from contract.
How do I know if my company is a data fiduciary or processor?
Apply the control test: if your organization decides why data is being processed and how, you're a fiduciary. If you're carrying out processing on someone else's instructions without deciding the purpose, you're a processor.
Can a company be both a fiduciary and a processor?
Yes. Role depends on the specific relationship, not the company as a whole. A firm can be a fiduciary for its own employee or customer data while acting as a processor for a client's data under a separate engagement.
Who is liable if a data processor causes a breach?
Under Section 8, the fiduciary bears non-delegable liability to the regulator and affected individuals, regardless of which party's error caused the breach. The fiduciary can then pursue recovery from the processor, but only if the data processing agreement includes indemnity terms covering that scenario.
Does a data processor have any obligations under the DPDP Act?
Yes, mainly through contract. A processor must follow the fiduciary's documented instructions, maintain agreed security safeguards, and report breaches to the fiduciary within the timelines set in the DPA.
Do we really need a data processing agreement?
Yes. The DPDP Act requires a valid contract before a fiduciary can engage a processor. Without one, the engagement isn't compliant, and the fiduciary has no contractual basis to recover losses if the processor's failure causes a breach.
Conclusion
The distinction between a data fiduciary and a data processor determines who the regulator holds accountable, who the data principal looks to, and who ultimately bears the regulatory exposure when a breach occurs.
The test itself is straightforward: whoever decides the purpose and means of processing is the data fiduciary and carries the primary responsibility under the DPDP Act.
Strengthening DPDP compliance starts with identifying your organization's role in each processing activity, mapping how personal data flows through your systems and vendors, and documenting every processor relationship with a contract that clearly defines responsibilities, security safeguards, breach reporting, and liability.
Leave a Comment