Data Fiduciary (DPDP Act)
Definition
Any person who alone or in conjunction with others determines the purpose and means of processing personal data; the DPDP Act equivalent of the GDPR 'controller'.
- Law
- India's Digital Personal Data Protection Act 2023
- GDPR equivalent
- Data controller
- Defining test
- Determines purpose and means of processing
- Can act
- Alone or jointly with others
Common questions
How does a data fiduciary's role differ practically from a data processor's under the DPDP Act?+
The fiduciary decides why and how personal data is processed and bears the primary statutory obligations under the Act, while the processor only carries out processing on the fiduciary's instructions and is bound by contract rather than by direct statutory duty, mirroring the controller-processor split under GDPR.
Can an organisation be a data fiduciary for some data and a data processor for other data?+
Yes, the classification depends on the specific processing activity and who determines its purpose and means for that activity, so the same organisation can be a fiduciary for data it collects directly from users and a processor when it handles data on another organisation's instructions.
Related terms
- Aadhaar Exclusion (DPDP Act S.17(2))
- Provision that exempts processing covered by the Aadhaar Act 2016 from the general DPDP Act regime, meaning UIDAI biometric data is governed...
- Adequate Country (GDPR Ch. V)
- A country that the European Commission has determined provides a level of data protection essentially equivalent to the EU's. As of mid-2026,...
- Biometric Identifier (BIPA)
- Under Illinois BIPA: a retina or iris scan, fingerprint, voiceprint, or scan of a person's hand or face geometry; distinct from 'biometric...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Explicit Consent (GDPR)
- A higher consent standard required for special-category data processing under Article 9(2)(a): must be freely given, specific, informed, and involve an explicit...
- Per-Violation Damages (BIPA)
- BIPA's statutory damages structure: USD 1,000 per negligent violation or USD 5,000 per intentional/reckless violation; confirmed by Cothron v. White Castle (2023)...
- Real-Time Remote Biometric Identification (RTBI)
- As defined in the EU AI Act: automated identification of natural persons at a distance by comparing their biometric data to those...
- Special-Category Data (GDPR)
- Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for unique identification, health data,...
- Standard Contractual Clauses (SCCs)
- Pre-approved contract terms issued by the European Commission that create GDPR-compliant safeguards for cross-border data transfers to countries without an adequacy decision....