ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXUnderstand who qualifies as a Data Fiduciary under India’s DPDPA and what it means for your business.
In simple terms, the Data Fiduciary decides why personal data is collected or processed and how that processing is carried out.
A Data Fiduciary is responsible for complying with applicable obligations under the DPDPA, including providing appropriate notice, obtaining valid consent where required, protecting personal data, responding to Data Principal requests, managing personal-data breaches, and demonstrating compliance.
The concept is broadly comparable to a data controller under the GDPR, although the DPDPA and GDPR use different legal frameworks and terminology.
Because a Data Fiduciary decides why personal data is collected and how it is processed, it also carries responsibility for how that data is collected, used, protected, and managed.
Identifying the role correctly is a practical question rather than a formality: it determines which obligations apply, who has to answer for them, and what a business needs to be able to show. Getting it wrong creates risk in areas such as:
These risks tend to compound. Weak consent and notice processes make the underlying obligations harder to meet, and missing records make compliance harder to demonstrate if a Data Principal or a regulator asks.
A Data Fiduciary is the organisation or person that determines the purpose and means of processing personal data.
For example, if an e-commerce company collects a customer's name, email address, phone number, and delivery address to process an order, the company may be the Data Fiduciary because it determines why and how that information is processed.
The term is important because responsibility under the DPDPA is not determined simply by who physically stores or handles the data. The organisation deciding the purpose and means of processing may have Data Fiduciary responsibilities.
A Data Fiduciary can be a company, organisation, individual, government entity, or other person that determines the purpose and means of processing personal data within the scope of the DPDPA.
Examples may include:
Whether a particular organisation is a Data Fiduciary depends on the processing activity and the role it performs.
The DPDPA places several responsibilities on Data Fiduciaries.
Depending on the applicable requirements, a Data Fiduciary may need to:
The DPDPA also requires Data Fiduciaries to remain responsible for processing carried out on their behalf by Data Processors.
Failing to meet these responsibilities creates compliance and regulatory risk for the organisation, and makes it harder to demonstrate that processing was lawful if a Data Principal or the Data Protection Board asks.
A Data Fiduciary decides why and how personal data is processed.
A Data Processor processes personal data on behalf of a Data Fiduciary.
For example:
The company decides why customer information is collected and how it is used to provide its services.
The provider may store or process the company's customer information on the company's behalf.
The distinction is important because the organisation that determines the purpose and means of processing generally remains responsible for fulfilling its Data Fiduciary obligations.
The term Data Fiduciary under the DPDPA is broadly comparable to the term Data Controller under the GDPR.
Both concepts generally refer to the party that determines the purposes and means of processing personal data.
However, they are not interchangeable legal terms.
| DPDPA | GDPR |
|---|---|
| Data Fiduciary | Data Controller |
| Data Principal | Data Subject |
| Data Processor | Data Processor |
| Consent Manager | No direct equivalent |
Businesses operating internationally should therefore assess each jurisdiction separately rather than assuming that GDPR compliance automatically satisfies DPDPA requirements.
Under Section 10 of the DPDPA, a Significant Data Fiduciary (SDF) is a Data Fiduciary that may be notified as significant by the Central Government based on factors such as the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State, or public order.
Significant Data Fiduciaries have additional compliance obligations.
These can include requirements relating to:
Organisations should determine whether they fall within any notified category rather than assuming that size alone makes an organisation an SDF.
Consent is an important part of DPDPA compliance.
Where processing is based on consent, the DPDPA requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.
The Data Fiduciary should also make it possible for the Data Principal to withdraw consent.
Withdrawal should be as easy as giving consent.
This means a Data Fiduciary needs more than a privacy policy. It needs a consent process that can communicate the purpose of processing, capture the user's choice, enforce that choice, and support withdrawal.
A Data Fiduciary should provide an appropriate notice explaining the personal data being processed and the purpose for processing.
For digital services, this can involve consent notices, privacy notices, cookie notices, application interfaces, registration forms, and other user-facing disclosures.
The objective is to give Data Principals enough information to understand what personal data is being processed and why.
Clear, purpose-specific notices also make it easier to connect consent records with the processing activities they relate to.
The DPDPA provides additional protections for children's personal data.
A child is an individual who has not completed 18 years of age under the Act.
Section 9 requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, subject to applicable provisions and exemptions.
The Act also restricts processing that is likely to cause a detrimental effect on a child's well-being and prohibits tracking, behavioural monitoring, and targeted advertising directed at children, subject to applicable provisions.
For services that may be used by children, Data Fiduciaries should therefore consider age-gating, parental consent, and technical controls for preventing prohibited processing.
Data Principals have rights under the DPDPA, and Data Fiduciaries need processes to support applicable requests.
These rights include:
A Data Fiduciary should have a clear process for receiving, verifying, tracking, and responding to applicable requests.
A Data Fiduciary may use Data Processors to perform services involving personal data.
Examples include:
The use of a Data Processor does not remove the Data Fiduciary's responsibility for ensuring that personal-data processing is appropriately governed.
Data Fiduciaries should therefore understand what data is shared with processors, why it is shared, how it is protected, and what contractual and operational controls apply.
Data Fiduciaries are expected to implement reasonable security safeguards to protect personal data.
Where a personal-data breach occurs, Section 8 of the DPDPA and applicable Rules establish requirements concerning breach notifications and related actions.
Organisations should therefore have an incident-response process that can identify, assess, document, and respond to personal-data breaches.
Security should be treated as an ongoing operational responsibility rather than a one-time compliance exercise.
A Data Fiduciary preparing for DPDPA compliance should consider:
Websites can act as Data Fiduciaries when they determine the purposes and means of processing personal data collected through online forms, accounts, cookies, analytics, advertising technologies, or other tracking mechanisms.
For this reason, cookie and tracker management can be part of a broader DPDPA compliance program.
A website should know:
A cookie consent banner alone does not necessarily address all of these requirements.
ConsentX exists to help Data Fiduciaries move beyond policy documents and actually operationalise DPDPA compliance — turning legal obligations into consent flows, records, and controls that work in practice, not just on paper.
ConsentX can help businesses:
This helps turn Data Fiduciary responsibilities into enforceable technical and operational controls rather than relying only on documentation.
ConsentX helps Data Fiduciaries turn DPDPA requirements into enforceable, provable privacy controls. Start free with ConsentX.
Under the DPDPA, a Data Principal is the individual to whom personal data relates.
A Data Processor is a person that processes personal data on behalf of a Data Fiduciary.
A Significant Data Fiduciary is a Data Fiduciary notified as significant by the Central Government and subject to additional obligations.
India's principal framework for the processing and protection of digital personal data.
A registered, interoperable platform through which a Data Principal can give, manage, review, and withdraw consent.
An individual appointed by a Significant Data Fiduciary to perform the responsibilities prescribed under the DPDPA framework.
Rights provided to individuals under the DPDPA, including applicable rights relating to access, correction, erasure, grievance redressal, and consent withdrawal.
A technology platform used to collect, manage, enforce, and document consent and privacy preferences.