Request a callback

Glossary · DPDP Act 2023 · s. 2(i)

Data Fiduciary

Definition

DPDP Act 2023 · s. 2(i)

The company or person who decides why and how personal data is processed. Under DPDP the Data Fiduciary carries the duties: notice, consent, security safeguards, breach reporting, erasure and answering people's requests. If a Data Processor does the work, the fiduciary still answers for it (s. 8(1)).

"Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
Also called controller (GDPR)business (CCPA)PII controller (ISO 27701)
Read the source

Sources: DPDP Act 2023, s. 2(i); GDPR, Art. 4(7)

In other laws

LawTermNote
GDPR (EU)Controller, Art. 4(7)Same test: decides purposes and means. Joint controllers are set out in Art. 26; DPDP covers that with "in conjunction with other persons".
CCPA / CPRA (California)Business, Cal. Civ. Code § 1798.140(d)Only for-profit entities above revenue or data thresholds; DPDP has no size threshold for the basic duties.
ISO/IEC 27701PII controllerA role the standard's controls attach to; the legal duties come from the law that applies.

Where it appears

s. 4

Grounds on which a Data Fiduciary may process personal data

s. 5

The notice a Data Fiduciary gives before or with a request for consent

s. 8

General obligations of Data Fiduciary

s. 10

Additional obligations of Significant Data Fiduciary

Sch.

Penalties for a Data Fiduciary's breaches, up to Rs 250 crore

Related terms

Significant Data FiduciaryData ProcessorData PrincipalConsent Manager

This page explains the law in plain English. It is not legal advice.