Privacy Glossary

Data Fiduciary

The Indian equivalent of a Data Controller under the DPDP Act — an entity that determines the purposes and means of processing personal data.

DPDP Act

Full Definition

Under India's Digital Personal Data Protection Act 2023, a 'Data Fiduciary' is any person or organisation who, alone or in conjunction with others, determines the purposes and means of processing personal data. The term reflects the fiduciary duty of care owed to the data principal (the individual). Data Fiduciaries must obtain valid consent, provide accessible privacy notices, respond to data principal requests, maintain data accuracy, and implement security safeguards. Certain Data Fiduciaries may be designated as 'Significant Data Fiduciaries' by the central government, attracting additional obligations.

How each law treats it

DPDP Act§ 2(i)

Any person who alone or in conjunction with others determines the purpose and means of processing personal data. The DPDP equivalent of GDPR's 'controller'.

DPDP Act (SDF)§ 10 + Rule 12

Significant Data Fiduciary designation adds DPO, DPIA, independent data audit, and expanded transparency obligations. Designation is made by the Government via notification.

GDPR comparisonArticle 4(7)

The 'Data Fiduciary' concept maps closely to the GDPR 'controller'. Operational obligations differ in detail but accountability sits with the Fiduciary.

In practice

Fiduciaries determine purpose and means — the test is substantive, not contractual. A customer-support BPO that decides which fields to collect becomes a Fiduciary even if the contract calls them a Processor.
SDF designation can be sector-based or volume-based. Watch the DPBI's periodic notifications and the DPDP Rules updates.
The Fiduciary's accountability survives the processor relationship — your Processor's miss is still your Section 8 breach.

Common pitfalls

Treating 'Data Fiduciary' and 'Data Processor' as interchangeable. They aren't. The Processor acts only on the Fiduciary's instructions.
Delaying the Grievance Officer appointment — Section 11 requires an identifiable contact who responds within the published redressal period.
Skipping the India-based DPO requirement once designated as SDF. The DPO must be based in India and must report to the board of directors.

Frequently asked questions

What makes a Data Fiduciary 'Significant'?+

Designation by Government notification based on volume of personal data, sensitivity of the data, risk to electoral democracy, security of the State, and public order. Specific sectoral triggers (payments, telecom, large consumer platforms) are expected.

Do all Data Fiduciaries need a DPO?+

No — only Significant Data Fiduciaries. Non-SDF Fiduciaries still need a Grievance Officer accessible under Section 11, who in practice fills part of the DPO role.

Can a start-up be a Significant Data Fiduciary?+

Yes, if it processes significant volume or sensitive data in a way that triggers the designation criteria. Volume isn't the only test — a small platform processing children's data can be designated.

Back to all terms