Data Fiduciary vs Data Processor Under the DPDP Act: Who Is Liable?

Every business that uses a payroll provider, a cloud host or a CRM shares personal data with another business. The Digital Personal Data Protection Act, 2023 (the DPDP Act) treats the two sides of that arrangement very differently. The difference between a data fiduciary and a data processor decides who answers to the Data Protection Board when something goes wrong, and what your vendor contracts must say.

Most obligations under the Act and the Digital Personal Data Protection Rules, 2025 come into force on 13 May 2027. Renegotiating vendor contracts takes time, so mapping these roles should start now. This article explains both roles, how to tell which one you play, and what a data processing agreement should include.

Data fiduciary meaning under the DPDP Act

Section 2(i) of the DPDP Act defines a data fiduciary as any person who, alone or together with others, determines the purpose and means of processing personal data. In plain terms, the fiduciary decides why personal data is collected and how it is used.

“Person” is defined widely and covers companies, firms, LLPs, individuals and the State. Almost every business is a data fiduciary for at least some data, such as its own employees’ records and its customers’ details. Because the definition includes “together with others”, two businesses that jointly decide how data is used can both be fiduciaries for that data.

Data processor under the DPDP Act

Section 2(k) defines a data processor as any person who processes personal data on behalf of a data fiduciary. The processor follows the fiduciary’s instructions and does not decide the purpose.

Common examples include payroll and HR software providers, cloud hosting companies, CRM and email marketing platforms, call centres and IT support vendors with access to customer records.

The Act does not place most compliance duties directly on processors. Their obligations come mainly through their contract with the fiduciary, which is why that contract matters so much.

Data fiduciary vs data processor: the key differences

Who decides. The fiduciary decides the purpose and means of processing. The processor acts on the fiduciary’s instructions.

Who is responsible. Under Section 8(1), the fiduciary is responsible for complying with the Act, including for any processing done on its behalf by a processor, regardless of any agreement to the contrary.

Who deals with individuals. The fiduciary gives privacy notices, obtains consent, and handles requests from individuals to access, correct or erase their data.

Who reports breaches. The fiduciary must inform the Data Protection Board and each affected individual of a personal data breach.

Who faces penalties. The penalties in the Schedule to the Act are imposed on the data fiduciary.

How to tell which role you play

The label in a contract does not decide the role. What matters is who actually controls the data. For each set of personal data, ask:

1. Who decided to collect this data, and for what purpose?
2. Who decides what data is collected, how long it is kept and who it is shared with?
3. Does the vendor use the data for any purpose of its own, such as improving its product or its own marketing?
4. Does the vendor act only on documented instructions?
5. Whose customers, employees or users are the people the data is about?

If the answers point to you, you are the fiduciary. If a vendor uses the data for its own purposes, it acts as a fiduciary for that use, and needs its own legal basis for it.

One business, two roles

Many businesses are both. A SaaS company is a processor for the data its clients upload to the platform, but a fiduciary for its own employees, website leads and billing contacts. The same applies to payroll providers, marketing agencies and IT firms. Map each set of data separately rather than giving the whole business one label.

Who is liable when a data processor causes a breach?

The data fiduciary. Section 8(5) requires the fiduciary to protect personal data in its possession or under its control, including data processed by a processor on its behalf, by taking reasonable security safeguards to prevent a breach.

Failing to take those safeguards can lead to a penalty of up to ₹250 crore. Failing to notify the Board and affected individuals of a breach can lead to a penalty of up to ₹200 crore. A fiduciary cannot shift this liability to its vendor in front of the Board. What a contract can do is let the fiduciary recover its losses from a vendor whose failure caused the breach.

What a data processing agreement should include

Section 8(2) allows a fiduciary to engage a processor only under a valid contract. Rule 6 of the DPDP Rules adds that this contract must include appropriate provisions requiring the processor to take reasonable security safeguards.

Clauses to include

• Instructions only: the processor handles data only for the specified purposes and on documented instructions.
• Security safeguards: measures such as encryption, access controls and monitoring, matching the minimum standards in Rule 6.
• Breach notice: the processor must inform the fiduciary quickly, well within 72 hours, since the fiduciary’s detailed report to the Board is due within 72 hours of becoming aware of a breach.
• Sub-processors: no further outsourcing without prior approval, with the same obligations passed down.
• Erasure: the processor deletes or returns the data when the contract ends or on instruction, since Section 8(7) requires the fiduciary to make its processor erase data it no longer needs.
• Logs and records: processing logs kept for at least one year, as the Rules require.
• Help with requests: support in responding to individuals’ requests for access, correction and erasure.
• Audit rights: the fiduciary’s right to check compliance.
• Liability and indemnity: clear allocation of losses caused by the processor’s failures.

For a wider list of documents to review, see our DPDP Act compliance checklist.

Significant data fiduciaries

Under Section 10, the government can notify certain fiduciaries as significant data fiduciaries, based on factors such as the volume and sensitivity of the data they handle and the risk to individuals. They carry extra duties, including appointing a Data Protection Officer based in India, an independent data auditor, and carrying out periodic data protection impact assessments. Vendors working for such businesses should expect stricter contracts and closer audits.

What to do before May 2027

1. List every vendor that handles personal data for your business.
2. Map whether you are the fiduciary or the processor for each set of data.
3. Review vendor contracts and add a data processing agreement where one is missing.
4. Align breach response timelines with your key vendors.
5. Update your privacy notice so it accurately reflects how data is processed. Our guide on whether your website needs a privacy policy covers what it should say.

Key takeaways

The data fiduciary decides why and how personal data is processed, and the data processor acts on its behalf. Under the DPDP Act, the fiduciary remains responsible for compliance, including for its vendors’ work, and bears the penalties. The contract is the main tool for managing that risk, so every vendor that handles personal data should be under a written agreement with proper security, breach and erasure clauses before May 2027.

This article is for general information only and is not legal advice.