DPDP Glossary

Data Processor

Any person who processes personal data on behalf of a Data Fiduciary.

Section 2(k)

What it means

Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Processors act on the Fiduciary’s behalf; the Fiduciary remains responsible under Section 8 for compliance in respect of processing undertaken by a Processor. Contracts should make instructions, security expectations and breach escalation clear.

Worked example

A hospital (Fiduciary) uses a transcription vendor to convert clinical audio to text strictly on the hospital’s instructions and purposes. The vendor is processing on behalf of the Fiduciary — typically a Processor relationship — not independently deciding new purposes for patient marketing.

In practice

Classify vendors by who decides purpose and means. Put Processor engagements under valid contracts, restrict use to documented instructions, and ensure breach and deletion obligations flow through. Mis-labelling a joint Fiduciary as a “processor” creates false comfort.

Source

Section 2(k) · Official text (PDF)

Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.

Further reading

Data FiduciaryAny person who alone or with others determines the purpose and means of processing of personal data.ProcessingA wholly or partly automated operation or set of operations performed on digital personal data, including collection, storage, use and sharing.Personal DataAny data about an individual who is identifiable by or in relation to such data.

← Back to glossary