Data Fiduciary vs Data Processor under DPDP

Every duty in the framework lands on someone. These two definitions decide who.

One test: who decides why and how

"“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data"

"“Data Processor” means any person who processes personal data on behalf of a Data Fiduciary"

If you decide why the data is collected and how it is used, you are the Data Fiduciary for that processing. If you only handle data under another organisation's instructions, you are their Data Processor for it. The words in conjunction with other persons also allow shared fiduciary decisions.

The roles attach per activity, not per company

Take a logistics company: for its own drivers and account holders it decides why and how the data is used, making it a Data Fiduciary; for the delivery addresses a marketplace passes it under instructions, it is that marketplace's Data Processor. Both roles at once is the normal state of affairs, not an edge case.

Responsibility does not transfer

Section 8 makes the fiduciary responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. Outsourcing the processing never outsources the responsibility. And engaging a processor for activity related to offering goods or services is allowed only under a valid contract, which is why processor contracts carry so much weight in a DPDP program.

What to do

Run the role checker with a specific processing activity in mind, and if vendors handle data for you, work the vendor and processor checklist against each engagement.