Data Fiduciary under the DPDP Act

A Data Fiduciary is the person or organisation that decides why personal data is processed and how that processing will be carried out. Under Section 2(i) of the Digital Personal Data Protection Act, 2023, it means any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.

Who qualifies as a Data Fiduciary?

The decisive test is control over the purpose and means of processing, not merely possession of data. Processing includes activities such as collecting, storing, using, sharing and erasing personal data.

• The Act's definition of person includes individuals, companies, firms, associations and the State, so both private organisations and government bodies can qualify.
• A bank that determines why and how customers' personal data is processed qualifies as a Data Fiduciary for that processing.
• Two or more persons can qualify where they jointly determine the purpose and means of processing.

How it differs from other participants

The Act distinguishes the decision-maker from the individual concerned and from an entity processing data on another's behalf.

• The Data Principal is the individual to whom the personal data relates.
• A Data Processor processes personal data on behalf of a Data Fiduciary; outsourcing processing does not remove the fiduciary's responsibility for compliance.
• The distinction depends on the role performed in the relevant processing activity, rather than an organisation's name or business category.

When the Act applies

Section 3 covers digital personal data processed within India where it was collected digitally or collected in non-digital form and subsequently digitised.

• Processing outside India is also covered when connected with offering goods or services to Data Principals within India.
• The Act excludes processing by an individual for a personal or domestic purpose.
• It also excludes personal data made publicly available by the Data Principal, or by another person legally obliged to make it public.

Responsibilities and enhanced obligations

A Data Fiduciary must process personal data for a lawful purpose on the basis of consent or certain legitimate uses recognised by the Act. Its obligations include reasonable security safeguards, breach notification and mechanisms for grievance redressal.

• Under Section 10, the Central Government may designate a Data Fiduciary or class of fiduciaries as significant, considering factors such as data volume, sensitivity and risks to individuals' rights.
• A Significant Data Fiduciary has additional obligations, including appointing a Data Protection Officer based in India and undertaking periodic impact assessments and audits.