Data Fiduciary, Data Processor, Data Principal: which one are you?

The DPDP Act sorts everyone who touches personal data into a few roles, and almost every duty in it is tied to one of them. Knowing which role you play is the first step to knowing what you owe. The roles are defined by what a person does with the data, not by size, sector or what the person calls itself.

The three roles side by side

Two further roles appear in many articles on this site:

Who counts as a “person”

The Act’s word “person” is wide. It includes an individual, a Hindu undivided family, a company, a firm, an association of persons or a body of individuals (incorporated or not), the State, and any other artificial juristic person. So an individual, a company and a firm can all be Data Fiduciaries. The Act does not apply to personal data an individual processes for a personal or domestic purpose.

What “personal data” and “processing” mean

Personal data is any data about an individual who is identifiable by or in relation to that data. Processing is a wholly or partly automated operation, or set of operations, on digital personal data. The Act’s list of examples includes collection, recording, storage, use, sharing, disclosure, restriction, erasure and destruction. A role therefore attaches as soon as you do any of these things with digital personal data of individuals.

How to tell Fiduciary from Processor

Ask who decides the purpose and the means. The Fiduciary decides. The Processor acts on the Fiduciary’s behalf. The Act gives one example: a telecom service provider hires a company to email telephone bills to its customers. The telecom provider is the Data Fiduciary and the emailing company is the Data Processor. The Rules give another: a company engages a cloud service provider to host customer records, and the cloud provider is the company’s Data Processor.

The definitions turn on what a person does with the data, not on a label in a contract. The same company can therefore be a Data Fiduciary for some data and a Data Processor for other data.

What follows for each role

• Data Fiduciary. Carries the duties, among them: a lawful purpose, notice and consent, accuracy, security safeguards, breach intimation, erasure, a published contact, and a grievance process. It is responsible for complying with the Act for processing it does itself or that a Data Processor does on its behalf, whatever the contract says.
• Data Processor. A Fiduciary may engage one for activities connected with offering goods or services to people only under a valid contract. The Fiduciary must cause its processors to stop processing when a person withdraws consent, unless the law requires or authorises it, and to erase data when erasure is due. See processors and vendors.
• Data Principal. Holds the rights: access, correction and erasure, grievance redressal and nomination, and has duties too, such as not impersonating another person or filing a false complaint. See rights and the 90-day limit.
• Significant Data Fiduciary. Carries extra duties once notified, among them: a Data Protection Officer based in India, an independent data auditor, a periodic impact assessment and audits.

The definitions have applied since 13 November 2025. The duties apply from 13 May 2027 (counted from 13 November 2025).

The child rule

The Act defines a child as an individual who has not completed eighteen years. For a child, the Data Principal includes the parents or lawful guardian, and a Fiduciary must obtain the verifiable consent of the parent, subject to the exemptions in the Fourth Schedule to the Rules, before processing a child’s personal data. Children’s data under the Act covers the consent test, the tracking ban and every exemption.

Check your own role

List each activity in which you handle personal data. For each, write down who decides why the data is used and who else touches it. That gives you a Fiduciary list, a Processor list and the vendors you must contract with. The processing map walks through this by the tools you use, and the applicability article covers the scope questions that come before it.