Businesses & Professionals
Your Role & Responsibilities Under DPDP
Where you sit under the DPDP Act decides what it asks of you. Work out whether you're a Data Principal, Data Fiduciary, Data Processor or Significant Data Fiduciary — and the duties and liability that come with each role.
Which DPDP role are you? Data Principal, Fiduciary, Processor or SDFData Principal, Data Fiduciary, Data Processor or Significant Data Fiduciary — your duties under India's DPDP Act depend on which one you are. A plain-English guide to placing yourself.Are you a Data Fiduciary? What the DPDP Act expects from youIf you decide why and how personal data is used, you're a Data Fiduciary under India's DPDP Act — and its core duties are yours. What's expected of you, in plain English.When you're both a Data Principal and a Data Fiduciary (dual roles)Under India's DPDP Act you can hold more than one role at once — a Data Principal for your own data, a Data Fiduciary for your customers'. How dual roles work, per dataset.Third-party vendors and data processors: who's responsible when things go wrong?If a vendor mishandles your customers' data, who answers for it under India's DPDP Act? The Fiduciary stays accountable — a contract can't shift it away. Explained, with fixes.Are you a Significant Data Fiduciary? How to tell if your company qualifiesYou become a Significant Data Fiduciary only when the government notifies you — based on data volume, sensitivity and risk. How to tell if your company is plausibly in scope.Data Fiduciary vs Data Processor: which one are you?Under India's DPDP Act, whoever decides why and how data is used is the Data Fiduciary; whoever acts on their instructions is the Processor. One test settles it — explained.Are you a Data Processor handling data for clients? Your duties when it isn't your dataAgencies, freelancers and SaaS often process client data on instructions — making them Data Processors under India's DPDP Act. What your duties are when the data isn't yours.Do solo professionals and small businesses count as Data Fiduciaries?Yes — India's DPDP Act has no size cut-off. A solo consultant or two-person shop collecting personal data is a Data Fiduciary. Is there any startup relief? Explained plainly.Your personal and business liability as a Data Fiduciary, explainedAs a Data Fiduciary you carry accountability for the data you hold — and a contract can't shift it. What you can be penalised for, and where 'personal' liability bites.