Privacy & Tech

What is a data fiduciary?

A data fiduciary is a person or organisation that determines why and how personal data is processed, either independently or together with others. This is a defined role under India’s Digital Personal Data Protection Act, 2023.

For example, a retailer deciding which customer details to collect and how to use them for order management acts as a data fiduciary for that processing.

Role	Meaning under the Indian framework
Data Fiduciary	Determines the purposes and means of processing personal data.
Data Processor	Processes personal data on behalf of a Data Fiduciary.
Data Principal	The individual to whom the personal data relates, with specified representative arrangements in certain cases.

The Act assigns responsibilities to data fiduciaries concerning matters such as notices, security safeguards and individual rights. Its provisions have phased commencement dates, so the applicable deadline must be checked for each obligation.

The role is broadly comparable to a data controller, but the legal terms and duties are not interchangeable across jurisdictions. A company’s actual decisions about processing determine its role, rather than the label used in a contract.