s.2 · s.8 · s.4
Data Fiduciary
A Data Fiduciary is any person who, alone or with others, decides the purpose and the means of processing personal data; it is the party the Act holds responsible.
The word fiduciary is chosen deliberately. The Act treats the business that decides why and how data is processed as holding that data in trust for the individual, and it attaches every core obligation to that role: notice, consent, security safeguards, breach intimation, grievance redressal, and answering for processors.
A business is a Data Fiduciary for its customers, its website visitors, its employees and its job applicants. A law firm or a chartered accountant is a Data Fiduciary for its own clients and staff, and is usually a Data Processor for the personal data inside a client engagement.
Section 8(1) makes the Data Fiduciary responsible for compliance with the Act even where the processing is done by a Data Processor on its behalf. Outsourcing the work does not outsource the duty.
Questions people ask
- Is a small business a Data Fiduciary?
- Yes, if it decides why and how any personal data is processed, which any business with customers does. Size affects which obligations bite hardest, not whether the role applies.
- Can there be more than one Data Fiduciary for the same data?
- Yes. The definition covers a person who decides purpose and means alone or in conjunction with others.
- What is the difference between a Data Fiduciary and a Data Processor?
- The Fiduciary decides; the Processor acts on the Fiduciary’s behalf. The Fiduciary stays responsible under Section 8(1) for what the Processor does.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.