# Data fiduciary

> A data fiduciary is the person or organisation that decides why and how personal data is processed. The term comes from India's Digital Personal Data Protection Act, 2023, which defines it as anyone who, alone or with others, determines the purpose and means of processing personal data. It is close to the GDPR's controller. A data processor handles data on a fiduciary's behalf. This is general information, not legal advice.

Source: https://milvao.com/glossary/data-fiduciary · Updated 2026-11-05

## Key takeaways

- The fiduciary decides; the processor follows the fiduciary's instructions.
- The fiduciary stays responsible for processing done on its behalf.
- One organisation can be a fiduciary for some data and a processor for other data.

## Data fiduciary vs data processor

|  | Data fiduciary | Data processor |
| --- | --- | --- |
| Decides purpose and means | Yes | No |
| Answers to the people the data is about | Yes | Through the fiduciary |
| Typical example | A business or community collecting member data | A software provider running a service for it |

## Duties of a data fiduciary

- Comply with the Act for all processing, including what its processors do on its behalf (section 8(1)).
- Engage a processor only under a valid contract (section 8(2)).
- Take reasonable security safeguards to prevent breaches (section 8(5)).
- Tell the Data Protection Board and each affected person about a breach (section 8(6)).
- Erase data when consent is withdrawn or the purpose is no longer served, and have its processor do the same (section 8(7)).

## Significant data fiduciaries

The government can notify some fiduciaries, or classes of them, as significant data fiduciaries, based on factors such as the volume and sensitivity of the data they process. They carry extra duties, including appointing a Data Protection Officer.

## Who is the data fiduciary in a community?

Usually the community, through its owner, since it decides which members join, what they are asked and why. When a community uses Milvao, it is the data fiduciary for members' data and Milvao is its data processor. Milvao is a data fiduciary itself for operator accounts, billing and website visitors. Details are on the [DPDP compliance](https://milvao.com/dpdp-compliance) page.

## Frequently asked questions

### Is a data fiduciary the same as a data controller?

They are close. The DPDP Act's data fiduciary and the GDPR's controller both describe whoever decides why and how personal data is processed, but each law attaches its own duties.

### Can a company be a data fiduciary and a data processor?

Yes, for different data. A software company is often a processor for its customers' data and a fiduciary for its own customer accounts.

### Does a data fiduciary need a contract with its processor?

Yes. The DPDP Act allows a fiduciary to use a processor only under a valid contract.

## Sources

- [MeitY: The Digital Personal Data Protection Act, 2023 (Gazette of India)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) (checked 2026-11-05)

## Related pages

- [DPDP Act](https://milvao.com/glossary/dpdp-act)
- [DPDP compliance](https://milvao.com/dpdp-compliance)
- [Data processing agreement](https://milvao.com/dpa)
- [Sub-processors](https://milvao.com/subprocessors)