Digitalization has opened the doors for growth in India. It has also increased the risk of personal and financial data breaches and misuse. Businesses are handling large volumes of data; responsible handling is mandatory. That’s why the DPDP Act provides clear responsibilities on entities that determine why and how such personal data is processed (called Data Fiduciary). Understanding the role is essential for businesses to avoid penalties and breaches. This guide explains the meaning, key obligations, and penalities a business must know.
What Is a Data Fiduciary? (Data Fiduciary Meaning)
A Data Fiduciary is the person or organization that decides why personal data be collected or used, and how that data should be processed. (Under Section 2 (i) of DPDP Act)
In simple words, if your organization decides why personal data is being collected and how it is processed, you are the Data Fiduciary regardless of who actually performs the technical processing.
Who Qualifies as Data Fiduciary?
Anyone can qualify as a Data Fiduciary if:
- Individuals or Organizations that decide why and how personal data will be processed
- Companies and businesses processing customer, employees, or users’ personal data.
- Government departments or authorities when they determine the purposes and means of processing.
- Entities processing data jointly, where they collectively determine the purpose and means of processing.
- These entities may use a Data Processor to handle personal data, but they remain responsible for ensuring compliance with the law.
Example of Data Fiduciaries
E-commerce Company
An online shopping company collects customer names, addresses, and purchase details to deliver orders and provide offers. Since the platform decides why and
how data is going to be used, it is a Data Fiduciary.
Employer
A company collects employees’ bank details, identification information, and attendance records for payroll and HR purposes. The company is the Data Fiduciary, while the payroll service provider may act as a Data Processor.
Key Obligations of a Data Fiduciary Under the DPDP Act
Data Fiduciary is required to handle personal data in a lawful, transparent, and secure manner. The key obligations are:
Lawful Processing (Section 4)
- Personal data of an individual should be processed only for a lawful purpose.
- The business must obtain the person’s consent and must have a legitimate reason to get it.
- Legitimate uses may include voluntary provision of data, delivery of state benefits, compliance with legal obligations, medical emergencies, employment-related purposes, and situations involving disaster or public order.
Provide Clear Notice (Section 5)
You should show clear notices to the person:
- What personal data is being collected
- Purpose of processing
- How Data Principals can use their rights
- How compliance can be made with the Data Protection Board
The notice must be provided in English or a language included in the Eighth Schedule, as applicable.
Notice should be provided before or along with the request for consent or, in the case of consent obtained before the Act, as soon as reasonably practicable.
Obtain and Manage Valid Consent (Section 6)
- Consent must be given freely and clearly, with full understanding of what it is for. Consent requests should use simple and easy-to-understand language.
- It must provide relevant contact details, including those of the Data Protection Officer (DPO), where applicable.
- Data Principals must be able to withdraw consent
- Following withdrawal, the Data Fiduciary and its Data Processors must cease processing within a reasonable time, unless another lawful basis for processing applies.
- It must show that the person was properly informed and gave consent.
Remain Accountable for Processing – Section 8
Remain responsible for compliance even when using a Data Processor and engage processors only through a valid contract.
- Ensure completeness, accuracy, and consistency of personal data where required
- Keep personal data safe by using proper security measures and prevent data breaches. If a data breach occurs, the Data Fiduciary must notify the affected individual and the Data Protection Board.
- Erase personal data when consent is withdrawn, or the purpose is no longer served, unless retention is legally required
- Share the DPO’s or contact person’s details.
- Provide an effective grievance redressal mechanism.
Children’s Data – (Section 9)
They need provide additional protection to children’s:
- Obtain verifiable parental consent
- Avoid processing data that can harm child well-being
- Not undertake tracking and behavioural monitoring
- Not use targeted advertising directed at children
Significant Data Fiduciary – (Section 10)
Significant Data Fiduciaries (SDFs) have some extra responsibilities. They are required to appoint an independent data auditor and a DPO based in India.
They must regularly check how they handle personal data and carry out audits. The DPO must report to the Board of Directors or a similar senior body.
What are the Penalties of Non-Compliance for Data Fiduciaries?
If the data fiduciary fail to comply with the regulation it may face the potential listed below:
| Non-compliance | Maximum Penalty |
| Not keeping personal data safe | ₹250 crore |
| Not reporting a data breach to the Board and affected people | ₹200 crore |
| Not protecting children’s data properly | ₹200 crore |
| Not following SDF requirements | ₹150 crore |
| Not following other rules under the Act | ₹50 crore |
Conclusion
Data Fiduciary refers to the person, organization and joint businesses that decide the purpose of collecting information of a person or data principal. The DPDP Act imposes mandatory obligations that a fiduciary must follow, including lawful processing, clear notice, and obtaining and managing valid consent. Failure to follow the DPDP obligations may bring penalties to businesses, along with losing customer trust and reputational damage.
FAQs
Ques: What does Data Fiduciary mean?
Ans: In simple terms, it is the person or organization that decides why and how personal data is collected or processed under the DPDP Act.
Ques: What is the difference between a data fiduciary and a data principal?
Ans: It’s the person or entity that collects the personal information, while a Data Principal is the person whose data is collected.
Ques: Is a Data Processor the same as a Data Fiduciary?
Ans: No, a Data Processor and a Data Fiduciary are not the same. Data Processor processes data as a third party, where the fiduciary determines the processing and purpose.
Ques: Does every Data Fiduciary need to appoint a Data Protection Officer (DPO)?
Ans: No, only significant data fiduciaries have to appoint a data protection officer.
