Data Fiduciary vs Data Processor: Who Carries the Liability?
TL;DR
A Data Fiduciary decides why and how personal data is processed, alone or with others. A Data Processor processes it on a fiduciary's behalf. Under the DPDP Act, the fiduciary carries the obligations and the liability, including for its processors (Section 8(1)), and may use processors only under a valid contract (Section 8(2)). Roles are decided activity by activity, and most organisations are both.
Who this is for: legal, procurement and business leaders who need to know which role their organisation plays in each relationship, and therefore who carries which obligations.
Every DPDP obligation attaches to a role. Notices, consent, security, breach reporting, rights and retention are all duties of the Data Fiduciary. The Data Processor is barely mentioned in the Act, yet it handles much of the world's personal data. Knowing which you are, for each processing activity, is the first question in any contract negotiation and any compliance plan.
The definitions
- Data Fiduciary (Section 2(i)): any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.
- Data Processor (Section 2(k)): any person who processes personal data on behalf of a Data Fiduciary.
- Data Principal (Section 2(j)): the individual the data relates to (including a parent or lawful guardian for a child or a person with a disability).
The test: who decides why and how?
Ask two questions about each processing activity:
- Who decides the purpose? Why is this data being processed at all?
- Who decides the essential means? Which data, about whom, kept for how long, shared with whom?
The party that answers those questions is the fiduciary. A party that only carries out the processing, following instructions, using its own tools and methods for the non-essential details, is a processor.
| Scenario | Fiduciary | Processor |
| A retailer uses a cloud provider to host its customer database | Retailer | Cloud provider |
| A company uses a payroll bureau to pay its employees | Company | Payroll bureau |
| A bank uses a call centre to handle customer queries | Bank | Call centre |
| A marketing agency runs campaigns using a client's list, as instructed | Client | Agency |
| The same agency builds its own audience data to sell to other clients | Agency | — |
| A SaaS vendor uses customer data to train its own product models | Customer for its own purposes; vendor becomes a fiduciary for its own use | — |
The last example is the one to watch. A processor that starts using data for its own purposes stops being merely a processor for that use.
Joint fiduciaries
Because the definition includes persons who decide "in conjunction with other persons", two organisations can be fiduciaries for the same processing: for example, co-branded credit card partners, or a platform and a seller that jointly decide how customer data is used. Joint fiduciaries should agree in writing who handles notices, consent, rights requests and breach notification, so that nothing falls between them.
Who carries what
| Obligation | Fiduciary | Processor |
| Notice and consent (Sections 5, 6) | Yes | Supports, as instructed |
| Lawful basis | Yes | No |
| Security safeguards (Section 8(5), Rule 6) | Yes, including for processing by processors | Through contract |
| Breach notification (Section 8(6), Rule 7) | Yes | Must tell the fiduciary, through contract |
| Rights requests (Sections 11–14) | Yes | Supports, through contract |
| Withdrawal and erasure (Sections 6(6), 8(7)) | Must cause processors to act | Acts on instruction |
| Penalties under the Schedule | Primary exposure | Mainly contractual exposure |
The core rule is Section 8(1): the fiduciary is responsible for complying with the Act, including for processing undertaken on its behalf by a processor. And under Section 8(2), it may engage a processor only under a valid contract. That contract is where processors' obligations live. See our guide to data processing agreements in India.
Why this matters for processors too
Processors may carry less direct exposure under the Act, but they are not unaffected. Their clients will push DPDP obligations down through contracts, with breach-notification windows, audit rights and indemnities. A processor that cannot support withdrawals, erasure or fast breach notice will lose deals. And a processor that uses client data for its own purposes becomes a fiduciary for that processing, with all the obligations that brings.
Mapping roles in practice
Record the role for each activity in your Record of Processing Activities, not once for the whole company. Then:
- for every activity where you are the fiduciary, list your processors and confirm contracts are in place
- for every activity where you are a processor, list your clients' instructions and confirm you can support their obligations
- for every joint arrangement, document who does what
Common mistakes
- Labelling the whole company. Roles are per activity.
- Trusting the contract's label. If a "processor" decides purposes, it is a fiduciary, whatever the contract says.
- Ignoring vendor product use. Vendors using your data for their own analytics or AI training change the relationship.
- No agreement between joint fiduciaries. Each assumes the other will handle requests and notices.
How ConsentifyAI helps
ConsentifyAI's ROPA module records your role for every processing activity, links each one to its processors, joint fiduciaries and contracts, and flags activities where a processor has no agreement in place. That map then drives where consent withdrawals and rights requests are routed.
Sources & references
- DPDP Act, 2023 — Section 2(i), 2(j), 2(k)
- DPDP Act, 2023 — Section 8(1), 8(2)
- DPDP Rules, 2025 — Rule 6
Frequently asked questions
What is a Data Fiduciary under the DPDP Act?
Any person who, alone or in conjunction with others, determines the purpose and means of processing personal data (Section 2(i)).
What is a Data Processor?
Any person who processes personal data on behalf of a Data Fiduciary (Section 2(k)).
Who is liable for a processor's breach?
The Data Fiduciary is responsible for compliance, including for processing undertaken on its behalf by a processor (Section 8(1)).
Can there be joint Data Fiduciaries?
Yes. The definition covers persons who determine purpose and means 'in conjunction with other persons', so two organisations can be fiduciaries for the same processing.
Can a company be both a fiduciary and a processor?
Yes. Roles are assessed per processing activity. A payroll provider is a fiduciary for its own staff and a processor for its clients' employee data.
Related reading
Third-Party Vendor Risk Under DPDP: Your Vendor's Breach Is Your Breach
Under Section 8(1) of the DPDP Act, a Data Fiduciary is responsible for compliance even when a vendor does the processing. Processors may only be engaged under a valid contract (Section 8(2)), and Rule 6 requires security safeguards to be written into it. Withdrawals, erasure and breaches all have to flow through your vendors on time. Effective vendor risk management means knowing every vendor, tiering them by risk, contracting properly, and monitoring continuously, not just at onboarding.
ReadData Processing Agreement in India: 10 Clauses You Can't Skip
Under Section 8(2) of the DPDP Act, a Data Fiduciary may engage a processor only under a valid contract, and Rule 6 requires that contract to include security safeguards. Because the fiduciary stays liable for its processors, the contract is where you make vendors meet your obligations. A DPDP-ready data processing agreement covers instructions, security, breach notification, rights support, sub-processors, transfers, deletion, audit, regulatory cooperation and liability.
ReadDoes the DPDP Act Apply to You? A 5-Minute Scope Test
The DPDP Act applies if you process digital personal data in India, or process it anywhere in connection with offering goods or services to people in India. There is no size, turnover or user threshold. The main exclusions are personal or domestic use and data the individual has made public themselves. The Section 17 exemptions are narrow, and even exempt processing must still be kept secure. For most businesses, the real question is not whether the Act applies, but which role you play and how heavy your obligations are.
Read