Understanding data fiduciaries, processors, and data principals

The data principal is the individual the personal data is about: an employee, a customer, a job applicant, a website visitor. This is the person whose rights the DPDPA is built around: to be informed, to access their data, to have it corrected or erased, and to withdraw consent.

The data fiduciary is the organisation that decides why and how personal data is processed (typically your own organisation, if you're collecting data from customers or employees). This is the role that carries most of the DPDPA's obligations: giving notice, obtaining consent, honouring data principal requests, securing the data, and reporting breaches.

A 'Significant Data Fiduciary' is a further designation the government can apply to fiduciaries handling data at a scale or sensitivity that warrants extra obligations, such as periodic audits and a Data Protection Officer based in India. Most organisations are not automatically in this category.

A data processor handles personal data on behalf of a data fiduciary, under the fiduciary's instructions: a payroll vendor, a cloud hosting provider, a customer support platform. The processor doesn't decide why the data is processed; it acts on the fiduciary's behalf.

Using a processor doesn't shift responsibility away from the fiduciary. This is the part that often trips teams up: if a vendor mishandles data you gave them to process, that's still your obligation to answer for, which is why vendor contracts and oversight matter (see the vendor review checklist below).

A consent manager is a separate, registered entity that lets a data principal give, manage, review, and withdraw consent across multiple fiduciaries through one interface. Most organisations won't operate as a consent manager themselves (it's a distinct, regulated role), but it's a term you'll see in the Rules alongside the others.