Key takeaways
- The fiduciary decides; the processor follows the fiduciary's instructions.
- The fiduciary stays responsible for processing done on its behalf.
- One organisation can be a fiduciary for some data and a processor for other data.
Data fiduciary vs data processor
| Data fiduciary | Data processor | |
|---|---|---|
| Decides purpose and means | Yes | No |
| Answers to the people the data is about | Yes | Through the fiduciary |
| Typical example | A business or community collecting member data | A software provider running a service for it |
Duties of a data fiduciary
- Comply with the Act for all processing, including what its processors do on its behalf (section 8(1)).
- Engage a processor only under a valid contract (section 8(2)).
- Take reasonable security safeguards to prevent breaches (section 8(5)).
- Tell the Data Protection Board and each affected person about a breach (section 8(6)).
- Erase data when consent is withdrawn or the purpose is no longer served, and have its processor do the same (section 8(7)).
Significant data fiduciaries
The government can notify some fiduciaries, or classes of them, as significant data fiduciaries, based on factors such as the volume and sensitivity of the data they process. They carry extra duties, including appointing a Data Protection Officer.
Who is the data fiduciary in a community?
Usually the community, through its owner, since it decides which members join, what they are asked and why. When a community uses Milvao, it is the data fiduciary for members' data and Milvao is its data processor. Milvao is a data fiduciary itself for operator accounts, billing and website visitors. Details are on the DPDP compliance page.
Sources
- MeitY: The Digital Personal Data Protection Act, 2023 (Gazette of India) (checked 5 November 2026)
Facts about WhatsApp and other services come from the pages listed, on the dates shown, and can change.