Data Processor
Definition
An entity that processes personal data on behalf of a data fiduciary, under the fiduciary's instructions. Equivalent to the data processor under GDPR. Processors are bound by contractual obligations from the fiduciary; direct statutory obligations fall on the fiduciary.
- Law
- India's Digital Personal Data Protection Act 2023
- GDPR equivalent
- Data processor
- Basis of obligation
- Contractual, from the fiduciary's instructions
- Statutory liability
- Falls primarily on the data fiduciary
Common questions
If a data processor mishandles personal data under the DPDP Act, who is legally accountable?+
Direct statutory obligations under the Act fall on the data fiduciary, not the processor, so the fiduciary bears primary regulatory liability even when a breach originates from a processor's system; the fiduciary's recourse against the processor is through their contract rather than a separate statutory claim.
Why would an organisation want a contract with clear data-handling terms even though the DPDP Act does not directly bind processors?+
Because the fiduciary carries the statutory risk for how a processor handles data, a well-drafted processing agreement, covering security measures, breach notification timing, and audit rights, becomes the fiduciary's main tool to manage exposure to obligations it cannot pass through to the processor by law.
Related terms
- Consent Notice
- A notice that must be provided to the data principal before or at the time of requesting consent. It must be clear,...
- Data Fiduciary
- The term used in India's Digital Personal Data Protection Act 2023 for an entity that determines the purpose and means of processing...
- Data Principal
- The individual to whom the personal data relates. Equivalent to the data subject under GDPR. The DPDP Act grants data principals rights...
- Data Protection Board of India (DPBI)
- The adjudicatory body established by the DPDP Act to receive complaints, investigate breaches of the Act, and impose penalties. The Board operates...
- Significant Data Fiduciary (SDF)
- A data fiduciary designated by the central government as carrying elevated risk based on data volume, sensitivity, national security considerations, or impact...