Article
Data Fiduciary, Data Processor, Data Principal: who’s who under the DPDP Act
29 Oct 2026 · Dpofficer.in team · 3 min read
Your role under the DPDP Act decides your duties. How to tell whether you’re a Data Fiduciary or a Data Processor, with everyday Indian examples.
Every DPDP conversation starts with one question: what is our role? The answer decides who owes duties to whom, who signs which contract, and who pays the penalty if things go wrong.
The Data Principal
The individual the data is about: your customer, employee, patient, student or website visitor. Two extensions matter:
- For a child (under 18), the Data Principal includes the parents or lawful guardian.
- For a person with a disability who has a lawful guardian, it includes the guardian acting for them.
The Data Fiduciary
Section 2(i): any person who, alone or with others, determines the purpose and means of processing personal data. “Person” includes individuals, companies, firms, trusts, government bodies and associations.
The test is control over why and how. If you decide that customer phone numbers will be collected at checkout and used to send delivery updates, you are the Data Fiduciary for that processing.
The Data Fiduciary carries almost all the obligations: notice, consent, security, breach reporting, accuracy, erasure, grievances and children’s data. Section 8(1) makes it responsible for compliance even when a processor does the actual processing.
The Data Processor
Section 2(k): any person who processes personal data on behalf of a Data Fiduciary. Typical processors:
- Cloud hosting and email delivery providers
- Payroll and HR software vendors
- Call centres and BPOs handling your customers
- Marketing agencies running your campaigns
The Act places few direct duties on processors. Instead, the fiduciary may engage a processor only under a valid contract (section 8(2)), and must make sure the processor protects the data and deletes it when asked.
Three everyday examples
| Situation | Data Fiduciary | Data Processor |
|---|---|---|
| A Coimbatore clinic stores patient records in a cloud app | The clinic | The cloud app provider |
| A company pays salaries through a payroll vendor | The company | The payroll vendor |
| A hospital and a diagnostics lab both decide how to use test results for their own purposes | Both, for their own processing | — |
When a vendor becomes a fiduciary
A processor that starts using your customers’ data for its own purposes, such as training its own product or selling insights, is deciding purposes itself. For that processing it becomes a Data Fiduciary, with all the duties that brings. Your contract should forbid this unless you’ve agreed to it.
Joint fiduciaries
The words “alone or in conjunction with other persons” mean two organisations can be fiduciaries together, for example co-branded loyalty programmes. Agree in writing who gives the notice, who answers requests, and who reports breaches.
Practical next step
Make a list of every vendor that touches personal data and label each one: processor or fiduciary. Then check that every processor has a contract covering security, breach reporting and deletion.
Go deeper
Our courses include vendor governance and contract templates. Browse the courses.
This article is for education and is not legal advice.
Get a new DPDP explainer every day
Follow dpdpcourse.in: