What is the difference between a Data Fiduciary, a Data Processor and a Significant Data Fiduciary under the DPDP Act, 2023?

Question

I've picked the AI, Data Analytics and Cyber Security elective in CS Professional. The DPDP Act has so many new terms. In a case study, how do I decide who is the Data Fiduciary and who is only a Data Processor? And what extra duties does a Significant Data Fiduciary have?

GradeHunt_Team · Answer

The test is simple: who decides why and how the personal data is processed?

Data Principal (Section 2(j)): the individual the personal data relates to. For a child, this includes the parent or lawful guardian, and for a person with a disability, the lawful guardian acting for them.

Data Fiduciary (Section 2(i)): any person who, alone or with others, determines the purpose and means of processing personal data. Most duties fall on the Data Fiduciary: consent or a legitimate use, notice, security safeguards, breach reporting and erasure once the purpose is over.

Data Processor (Section 2(k)): any person who processes personal data on behalf of a Data Fiduciary. A processor can be engaged only under a valid contract, and the Data Fiduciary remains responsible for what the processor does with the data.

Significant Data Fiduciary (Section 10): a Data Fiduciary or class of them that the Central Government notifies, based on factors such as the volume and sensitivity of data processed and the risk to Data Principals. Its extra duties:
1. Appoint a Data Protection Officer based in India, who answers to the Board of Directors (or similar governing body) and handles grievance redressal.
2. Appoint an independent data auditor.
3. Carry out a periodic Data Protection Impact Assessment and a periodic data audit.

Note on dates: the Act is coming into force in phases. The definitions in Section 2 have applied since 13 November 2025. The duties of Data Fiduciaries and Significant Data Fiduciaries (Sections 4 to 10) apply from 13 May 2027.

Case study example: an online pharmacy collects customers' names, addresses and prescriptions to sell medicines. It uses a cloud company to store the data and a courier firm to deliver.
- The pharmacy decides the purpose and means, so it is the Data Fiduciary.
- The cloud company only stores data on the pharmacy's instructions, so it is a Data Processor.
- The courier firm uses names and addresses only to deliver orders for the pharmacy, so it is also a Data Processor.
- If the cloud company uses the prescriptions for its own analytics, it decides a purpose of its own and becomes a Data Fiduciary for that processing.
- The pharmacy becomes a Significant Data Fiduciary only if the Government notifies it (or its class). Handling health data does not make it one automatically.

In an open book paper, cite the clause of Section 2 and then apply the "who decides purpose and means" test to each party in the facts.

What is the difference between a Data Fiduciary, a Data Processor and a Significant Data Fiduciary under the DPDP Act, 2023?

1 answer