The DPDPA assigns different obligations to different roles. Before building a compliance programme, an organisation needs to determine where it stands: is it a Data Fiduciary, a Data Processor, or both depending on the activity? Getting this wrong leads to over-engineering in some areas and dangerous gaps in others. It also shapes contracts, liability and commercial negotiations.

This article explains how the roles work and how to analyse your position. As always, apply the current Act and rules to your specific facts, with legal advice where stakes are high.

The definitions

Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data. This is the decision-maker: the entity that decides why data is collected and how it will be used.

Data Processor means any person who processes personal data on behalf of a Data Fiduciary. The processor acts on the fiduciary's instructions and does not decide the purposes.

The Act places most obligations on the Data Fiduciary, including consent, notice, accuracy, security, breach notification, retention, rights handling and grievance redressal. The Data Fiduciary is also responsible for processing carried out by its processors on its behalf. Processors may be bound by contract and may have direct exposure for their own failures, such as inadequate security safeguards, depending on how the Act and rules apply, so processors should not assume they are outside the regime.

Everyday examples

  • A retailer that collects customer details for orders and marketing is a Data Fiduciary for that data.
  • A cloud hosting provider storing the retailer's customer database is typically a processor.
  • A payroll service provider processing employee data on an employer's instructions is typically a processor; the employer is the fiduciary.
  • A marketing agency running campaigns using a client's customer list is generally a processor for that activity.
  • A SaaS platform that stores customers' data and processes it as customers instruct is a processor for that data, but a Data Fiduciary for its own account holders' data, such as billing contacts and platform usage analytics it uses for its own purposes.
  • A bank is a Data Fiduciary for customer data; its IT services vendors are processors.

Roles are activity-specific

A single organisation often wears both hats. An Indian IT services firm may be a processor when working on a client's data and a fiduciary for its own employee and vendor data. A SaaS company may be a processor for customer content and a fiduciary for marketing leads. Analyse role per processing activity, not per company.

Tests to apply

Ask:

  1. Who decides why the data is processed? If you decide the purpose, you lean toward fiduciary.
  2. Who decides the essential means? Choice of what data to collect, from whom, for how long and who gets it points to the decision-maker.
  3. Do you process only on documented instructions? If yes, processor.
  4. Do you use the data for your own purposes? If you do, for example analytics or product development for your own benefit, you may be acting as a fiduciary for that use.
  5. How do contracts describe the relationship? Labels in contracts matter but do not override reality. A contract calling you a processor while you decide purposes will not protect you.

Obligations by role

For Data Fiduciaries:

  • Establish a lawful basis, including valid consent or a legitimate use.
  • Give clear notices.
  • Implement reasonable security safeguards.
  • Notify breaches to the Board and affected individuals.
  • Handle rights requests and grievances.
  • Limit retention and erase data when required.
  • Engage processors under valid contracts and ensure compliance.
  • Meet additional duties for children's data.
  • If designated a Significant Data Fiduciary: appoint a Data Protection Officer based in India, an independent data auditor, and carry out periodic data protection impact assessments and audits.

For Data Processors:

  • Process only per the fiduciary's instructions and the contract.
  • Maintain security safeguards appropriate to the processing.
  • Assist the fiduciary with breach response, rights requests and deletion.
  • Manage sub-processors in line with contractual terms.
  • Return or delete data on termination.

Contract essentials

A data processing agreement between a fiduciary and a processor should cover:

  • Scope, purposes and categories of data.
  • Instructions and limits on use.
  • Security requirements, aligned with recognised frameworks.
  • Breach notification timelines and cooperation duties.
  • Sub-processor approval and flow-down.
  • Assistance with rights requests and audits.
  • Data location and transfer restrictions, noting that the Act permits transfers outside India except to countries the government restricts, subject to sectoral laws that may be stricter.
  • Retention, return and deletion.
  • Liability and indemnities.
  • Audit and inspection rights.

Commercial implications

For service providers, being clearly a processor can reduce some obligations but increases contractual scrutiny from customers. Indian outsourcing firms handling data for global clients also deal with other regimes such as the GDPR, so aligning contracts across jurisdictions is important. For companies buying services, strong processor oversight is not optional, because liability for misuse generally follows the fiduciary.

Common mistakes

  • Assuming "we are just a vendor" and ignoring obligations for data used for own purposes.
  • Treating every vendor as a processor without checking whether they decide purposes.
  • Signing generic data protection clauses that do not reflect the actual processing.
  • Forgetting sub-processors.
  • Failing to map data flows, so roles remain unclear.
  • Overlooking that employee data makes every employer a Data Fiduciary.

How to map your roles

  1. List processing activities and data categories.
  2. For each, identify the parties involved.
  3. Apply the tests above to determine who is fiduciary and who is processor.
  4. Record the analysis and revisit when business models change.
  5. Align contracts, security measures and operational processes accordingly.

Get clarity

F9 Infotech helps organisations map their data flows, determine roles under the DPDPA, review processor agreements and design compliance programmes that fit. Map your DPDPA role with a free consult.

This article is general information, not legal advice. Roles should be determined on the facts, with qualified legal input.