Data Fiduciary vs Data Processor Under the DPDP Act 2023: Who Carries the Legal Risk?

Data fiduciary vs data processor is the first question every Indian business must know under the DPDP Act 2023. A Data Fiduciary determines the purpose and method of processing personal data. A Data Processor only processes data on the fiduciary’s behalf under a contract. The fiduciary is liable for all legal duties and penalties up to Rs 250 crore.

 

The processor answers to the fiduciary, not directly to the law. That is why everyone suddenly wants to be a processor. But the label in your contract does not decide your role. Your actions do. Here is how the law actually classifies you.

What Is a Data Fiduciary Under the DPDP Act?

Under Section 2(i) of the DPDP Act 2023, a Data Fiduciary is defined as “any person who alone or in conjunction with other persons determines the purpose and means of processing personal data.”

 

In simple words, if you decide what data to collect and why, you are the fiduciary.

 

Banks, NBFCs, e-commerce platforms, hospitals, insurers, and apps that collect customer data for their own use are all fiduciaries.

 

As a Data Fiduciary, you must:

• Give notice: Tell users what data you collect and why, in clear language.
• Take valid consent: Under Section 6, consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action.
• Protect the data: Implement security measures to protect personal data.
• Report breaches: Inform affected users without delay and give the Data Protection Board a detailed report within 72 hours. Failure to notify can cost up to Rs 200 crore.
• Erase data: Delete personal data once the purpose is served or consent is withdrawn.
• Follow purpose limitation: Collect personal data only for lawful, specific, and clear purposes. Do not use data for anything else without fresh consent.
• Practice data minimization: Gather only the personal data required for your purpose. Avoid asking for extra information that is not necessary.
• Set up grievance redressal: Create a system where Data Principals can file complaints and get timely responses about their data.

What is a Data Processor Under the DPDP Act?

Under Section 2(k) of the DPDP Act 2023, a Data Processor is defined as any person who processes personal data “on behalf of a Data Fiduciary.” The processor decides nothing. It executes. Cloud hosts, payment processors, SMS vendors, KYC verification APIs, and outsourced call centres typically fall here.

 

Now, the part most articles get wrong. The DPDP Act places no direct statutory duties on processors. That is different from GDPR, where processors have their own legal obligations. In India, a processor’s duties come entirely from its contract with the fiduciary under the DPDP Compliance. That is why Section 8(2) allows a fiduciary to engage a processor only under a valid contract. The contract is not paperwork. It is the only thing binding your processor to protect your data.

 

What is the difference between a Data Fiduciary and a Data Processor?

Aspect	Data Fiduciary	Data Processor
Definition	Decides purpose and means of processing (Section 2(i))	Processes data on behalf of a fiduciary (Section 2(k))
Who decides	Decides what data to collect and why	Follows instructions only
Duties come from	The DPDP Act itself	The contract with the fiduciary
Consent and notice	Must collect consent and give notice to users	No direct consent duty
Breach reporting	Must notify users and the Data Protection Board	Must inform the fiduciary as per the contract
Penalty exposure	Up to Rs 250 crore under the Act	Contractual claims, not direct DPDP penalties
Example	An NBFC collecting borrower KYC data	A cloud vendor storing that data

What are the Common Mistake Most Vendors do?

Most companies use a shortcut: whoever collects data from the customer is the fiduciary, and everyone who receives data after that is a processor. That shortcut is wrong. The law does not care who touched the data first. It does not care who has the contract with the customer. It only asks one thing: who decided the purpose and means of processing?

 

An entity that receives data from you but uses it for its own purposes is a fiduciary for those purposes. No contract label can change that.

How to classify a vendor?

Run every data relationship through these three questions:

• Who decided the purpose? Why is this data being processed at all? Whoever answers that question is leaning fiduciary.
• Who decided the means: Who chose what data is needed and how it gets processed?
• Does the entity act only on instructions? If yes, with no purpose of its own, it is a processor. If it exercises real autonomy or pursues its own purpose, it is a fiduciary for that purpose.

 

One Loan Application, Five Data Roles

Say Rakesh applies for a personal loan on an NBFC’s app. Watch how the roles split.

 

The NBFC: It decided to collect Rakesh’s PAN, bank statements, and selfie for credit underwriting. It chose the purpose and the means. Clear Data Fiduciary.

 

The cloud provider: It stores the data only as instructed by the NBFC and does not decide how or why the data is used. It acts as a Data Processor.

 

The KYC verification API: It verifies the PAN and documents the NBFC sends, for the NBFC’s purpose, on the NBFC’s instructions. Data Processor.

 

The credit bureau: Here is the twist. The NBFC requests a credit report, but the bureau collects and retains credit data under its own framework, for its own purposes, across thousands of member institutions. It decides its own means. The bureau is a Data Fiduciary in its own right, not the NBFC’s processor.

 

The SMS vendor: Sending OTPs on instructions, it is a processor. The moment it reuses Rakesh’s number for its own marketing, it becomes a fiduciary for that activity and picks up full DPDP liability for it.

 

Same loan. Five entities. Three different answers. This is why role mapping needs an entity-by-entity review, not assumptions. This is the DPDP compliance for NBFC as a Data Fiduciary.

What are Significant Data Fiduciaries?

The government can notify certain fiduciaries as Significant Data Fiduciaries (SDFs) based on:

• Volume and sensitivity of data processed
• Risk to Data Principals
• Impact on the sovereignty or integrity of India
• Potential harm to individuals

Extra duties for SDFs:

• Appoint a Data Protection Officer (DPO) based in India
• Conduct Data Protection Impact Assessments (DPIA) for high-risk processing
• Get periodic audits done by an independent auditor
• Maintain Records of Processing Activities (RoPA)

What Your Processor Contracts Must Cover?

Since the DPA (Data Processing Agreement) is the only thing binding your processor, it must clearly cover:

• Scope and purpose: Exactly what data the processor handles and for what.
• Security safeguards: Specific technical measures, not vague promises.
• Breach reporting timeline: The processor must alert you within hours, because you have only 72 hours to file the detailed report with the Board.
• Sub-processor approval: No fourth party touches your data without your written consent.
• Deletion and return: What happens to the data when the contract ends, or consent is withdrawn?.
• Audit rights: Your right to verify all of the above.

The DPDP Rules were notified in November 2025, and core obligations take full effect by May 2027. Mapping every vendor, classifying each role, and fixing dozens of contracts takes months. Platforms like SureGrid help you discover where personal data sits, classify your vendor relationships, and run consent and breach workflows from one place.

Conclusion

The difference is simple once you see it. The Data Fiduciary decides; the Data Processor executes. But the legal weight is not equal. The fiduciary answers for everything under the DPDP Act, including what its vendors do with personal data. And no contract label can turn a fiduciary into a processor if the facts say otherwise. 

 

So audit every data flow with the three-question test. Who decided the purpose? Who decided the means? Who merely follows instructions? Map that honestly, fix your processor contracts, and you have closed the biggest DPDP gap most Indian companies are still ignoring. The businesses that sort this out before May 2027 will have a far easier compliance journey than those who wait.

FAQs

Ques: What Is a Data Fiduciary?

Ans: A Data Fiduciary is any person or entity that decides the purpose and means of processing personal data under the DPDP Act 2023. Banks, NBFCs, hospitals, and apps that collect customer data for their own use are all Data Fiduciaries.

 

Ques: What Is the Difference Between a Data Steward and a Data Processor?

Ans: A data steward is an internal role, an employee responsible for data quality and governance inside a company. A data processor is an external entity that processes personal data on a fiduciary’s behalf under contract. The DPDP Act defines processors, not stewards.

 

Ques: What Is the Difference Between Data Fiduciary vs Data Processor?

Ans: The fiduciary decides why and how data is processed and carries full legal accountability, including penalties up to Rs 250 crore. The processor only acts on the fiduciary’s instructions, and its duties come from the contract, not directly from the Act.

 

Ques: What Is a Data Fiduciary vs Data Processor Example?

Ans: An NBFC collecting borrower KYC data for loan approval is the Data Fiduciary. The cloud vendor storing that data and the KYC API verifying documents on its behalf are Data Processors. The credit bureau pulling the borrower’s report is a separate Data Fiduciary in its own right.

 

Ques: Can a Company Be Both a Data Fiduciary and a Data Processor?

Ans: Yes, the role depends on the activity, not the company. A cloud firm storing client data is a processor for that work. But when it collects its own employee or customer data, it is a fiduciary for that data. Many B2B companies play both roles at the same time.