What is a Data Fiduciary?

A Data Fiduciary is any person, company, or body that decides why and how personal data is processed. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), it’s the organisation in control of the data — the one that collects and uses it, alone or together with others.

Educational resource only — not legal advice.

The Data Fiduciary carries the law’s main duties: giving a clear notice, taking valid consent, using the data only for the stated purpose, keeping it secure, honouring people’s rights, and being able to prove consent if it’s ever questioned. The accountability sits with the fiduciary, not the individual.

Why it matters to you. If you run a clinic, shop, agency, coaching class, or app that collects customer or client data, you are almost certainly a Data Fiduciary — these obligations are yours. If instead you’re the person whose data is collected, the Data Fiduciary is who is answerable to you.

What it is not. A Data Fiduciary is not a Data Processor — a processor only handles data on the fiduciary’s instructions, for the fiduciary’s purposes, not its own. A Significant Data Fiduciary is a higher-risk subset (named by the government based on volume and sensitivity of data) that carries extra obligations.