When you're both a Data Principal and a Data Fiduciary (dual roles)

At a glance

Under India’s DPDP Act the roles aren’t exclusive — you can hold more than one at the same time, decided per dataset. You’re a Data Principal for your own personal data (the rights are yours), and a Data Fiduciary for the customer, client, or employee data your business holds (the duties are yours). A business owner is almost always both at once. The trick is knowing which hat you’re wearing for which data — that’s what tells you whether you have rights or owe duties in a given situation.

Educational resource only. This explains how overlapping roles work under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

Why this trips people up

People assume they’re one thing under the law — “I’m a business, so I’m a Fiduciary.” But you don’t stop being an individual with your own data rights just because you also run a business. Both are true at once, and they apply to different data. Seeing that clearly removes most of the confusion about who owes what to whom.

How you end up in two roles at once

The role attaches to the data, not to you as a person — so different datasets put you in different roles simultaneously. Consider a coaching-class owner. When a company holds her Aadhaar and PAN for her own bank account, she’s a Data Principal — the individual whose data it is. When she collects students’ names, parents’ numbers, and fee records, she’s a Data Fiduciary — the one deciding why and how that data is used.

Same person, same day, two roles — because there are two different sets of data. This is the normal state for almost every business owner and professional.

Your Principal hat: the rights are yours

As a Data Principal you hold rights you can exercise against the businesses that hold your data. For your own personal data — with your bank, your SaaS tools, your vendors — you can give and withdraw consent, ask what’s held, get errors corrected, and request deletion. These are the same rights your customers have against you. Knowing them from this side is useful: it’s the clearest way to understand what your own customers are entitled to expect.

Your Fiduciary hat: the duties are yours

As a Data Fiduciary you carry the obligations for the data your business decides the purpose for. For your customers’, clients’, and employees’ data, the duties are yours: notice, consent, security, breach reporting, deletion when done, a grievance route, and honouring rights requests. When one of your customers exercises a right, you’re on the receiving end — wearing the Fiduciary hat.

There’s often a third hat, too: if you handle data on a client’s instructions (an agency, a freelancer, a SaaS), you’re a Data Processor for that data. Many businesses wear all three across different datasets.

Reading the situation: which hat am I wearing?

Ask whose data it is and who decided the purpose — the answer tells you your role and therefore your position. A quick way to place yourself:

• Is it my own personal data, held by someone else? → You’re a Principal; you have rights.
• Is it data my business collected and decided the use for? → You’re a Fiduciary; you owe duties.
• Is it a client’s data I’m handling on their instructions? → You’re a Processor; you’re bound by their contract.

Run that check per dataset and the “do I have rights here or owe duties here?” question answers itself.

FAQ