Data Fiduciary under the DPDP Act: meaning, duties and SDF rules
Who counts as a Data Fiduciary, how it differs from a Data Processor and a Consent Manager, what section 8 requires of every fiduciary and what changes for a Significant Data Fiduciary.
Last updated 22 October 2026
What is a Data Fiduciary under the DPDP Act?
A Data Fiduciary is any person, company or body that, alone or with others, decides why and how personal data is processed. It carries the main duties under the DPDP Act: notice and consent, security safeguards, breach intimation, erasure and grievance redressal. The government can notify some as Significant Data Fiduciaries, which then owe extra duties.
How does the DPDP Act define a Data Fiduciary?
Section 2(i) of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) defines a Data Fiduciary as any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. “Person” is wide under section 2(s): it includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and every artificial juristic person.
The test is control, not size or sector. A two-person clinic that decides what patient details to collect is a Data Fiduciary for that data, just as a bank is. The Act applies to digital personal data, including data collected on paper and digitised later (section 3).
How is a Data Fiduciary different from a Data Processor and a Consent Manager?
| Role | Definition in the Act | Who it acts for | Main duties |
|---|---|---|---|
| Data Fiduciary | Determines the purpose and means of processing (s. 2(i)) | Itself | All Chapter II duties: notice, consent, safeguards, breach intimation, erasure, grievances (ss. 4–10) |
| Data Processor | Processes personal data on behalf of a Data Fiduciary (s. 2(k)) | The Data Fiduciary, under a valid contract (s. 8(2)) | Works under the fiduciary’s contract; the fiduciary stays responsible for its processing (s. 8(1)) |
| Consent Manager | A person registered with the Board, acting as a single point of contact for a Data Principal to give, manage, review and withdraw consent (s. 2(g)) | The Data Principal (s. 6(8)) | Registration conditions and obligations in Rule 4 and the First Schedule |
| Significant Data Fiduciary | A Data Fiduciary or class notified by the Central Government under section 10 (s. 2(z)) | Itself | Everything a Data Fiduciary does, plus a DPO, an independent data auditor, DPIAs and audits (s. 10(2), Rule 13) |
Read more on the Consent Manager role, which is often confused with consent software.
What must every Data Fiduciary do under section 8?
Section 8 sets the general obligations. Each sub-section, with the rule that adds detail where one exists:
| Provision | What it requires | Detail in the Rules |
|---|---|---|
| s. 8(1) | Responsible for compliance for its own processing and processing by its Data Processors, whatever any agreement says | — |
| s. 8(2) | Engage a Data Processor only under a valid contract | Rule 6(1)(f): the contract must provide for reasonable security safeguards |
| s. 8(3) | Ensure completeness, accuracy and consistency where data is used for a decision about the Data Principal or disclosed to another fiduciary | — |
| s. 8(4) | Implement appropriate technical and organisational measures to observe the Act and Rules | — |
| s. 8(5) | Take reasonable security safeguards to prevent personal data breach | Rule 6: encryption, masking or tokens; access control; logs and monitoring; backups; one-year log retention |
| s. 8(6) | Intimate each personal data breach to the Board and each affected Data Principal | Rule 7: without delay, then a detailed report to the Board within 72 hours |
| s. 8(7) | Erase personal data when consent is withdrawn or the purpose is no longer served, unless law requires retention, and make processors erase too | Rule 8: Third Schedule periods and a 48-hour pre-erasure intimation |
| s. 8(8) | Purpose is deemed no longer served if the Data Principal neither approaches the fiduciary nor exercises her rights for a prescribed period | Rule 8 and the Third Schedule |
| s. 8(9) | Publish business contact details of a DPO, if applicable, or a person who can answer questions about processing | Rule 9: prominently on the website or app, and in every rights response |
| s. 8(10) | Establish an effective mechanism to redress grievances | Rule 14(3): respond within a period not exceeding ninety days |
Which other sections bind every Data Fiduciary?
- Lawful grounds (s. 4). Process only for a lawful purpose, with consent or for one of the “certain legitimate uses” listed in section 7.
- Notice (s. 5). Every consent request is accompanied or preceded by a notice; Rule 3 lists what it must contain. It must be available in English or any Eighth Schedule language (s. 5(3)).
- Consent (s. 6). Free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and as easy to withdraw as to give. If challenged, the fiduciary must prove notice and consent (s. 6(10)).
- Children (s. 9). Verifiable parental consent before processing a child’s data, no processing likely to harm a child’s well-being, and no tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 sets how parental consent is verified.
- Data Principal rights (ss. 11–14). Access to a summary of data and processing, correction and erasure, grievance redressal and nomination.
When do these duties apply?
The definitions in section 2 have been in force since 13 November 2025. The operative provisions, sections 3 to 17 (other than section 6(9)), come into force on 13 May 2027 under the Act’s commencement notification, G.S.R. 843(E) of 13 November 2025 (Gazette notification). The matching Rules, Rules 3 and 5 to 16, also come into force eighteen months after publication (13 May 2027) (DPDP Rules, 2025, Rule 1(4)). So a Data Fiduciary’s operative duties, and the penalties under section 33 and the Schedule, apply from 13 May 2027.
What makes a business a Significant Data Fiduciary?
Section 10(1) lets the Central Government notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary (SDF) after assessing relevant factors, including:
- the volume and sensitivity of personal data processed;
- risk to the rights of Data Principals;
- potential impact on the sovereignty and integrity of India;
- risk to electoral democracy;
- security of the State; and
- public order.
There is no turnover or user-count threshold in the Act. The assessment is carried out by an officer of the Ministry of Electronics and Information Technology designated by its Secretary (Seventh Schedule, item 3, to the Rules). So SDF status is something the government notifies, not something a business works out for itself.
What extra duties does a Significant Data Fiduciary have?
| Duty | Source | What it means |
|---|---|---|
| Data Protection Officer | s. 10(2)(a) | An individual who represents the SDF under the Act, is based in India, is responsible to the board of directors or similar governing body, and is the point of contact for grievance redressal |
| Independent data auditor | s. 10(2)(b) | Appointed to carry out a data audit evaluating the SDF’s compliance with the Act |
| Periodic DPIA | s. 10(2)(c)(i) | A Data Protection Impact Assessment describing Data Principals’ rights and the purpose of processing, and assessing and managing the risk to those rights |
| Periodic audit | s. 10(2)(c)(ii) | Separate from the DPIA |
| Annual cycle | Rule 13(1) | A DPIA and an audit once in every period of twelve months from the date of notification |
| Report to the Board | Rule 13(2) | The person carrying out the DPIA and audit furnishes the Board a report of significant observations |
| Algorithmic due diligence | Rule 13(3) | Verify that technical measures, including algorithmic software used to host, display, upload, modify, publish, transmit, store, update or share personal data, are not likely to pose a risk to Data Principals’ rights |
| Data localisation where specified | Rule 13(4) | Personal data specified by the Central Government on a committee’s recommendation, and the traffic data on its flow, is not transferred outside India |
Breach of the additional SDF obligations under section 10 carries a penalty that may extend to ₹150 crore (section 33 and item 4 of the Schedule to the Act). The PIB release on the Rules summarises the SDF duties as independent audits, impact assessments and stronger due diligence for deployed technologies.
Who is a Data Fiduciary in practice?
These generic examples show how the roles usually fall. The answer always turns on who decides the purpose and means for a particular processing activity.
| Business | Data Fiduciary for | Typical Data Processors |
|---|---|---|
| Online shop | Customer accounts, orders, delivery addresses, marketing lists | Cloud host, payment gateway, courier, email service |
| Clinic or hospital | Patient records, appointments, staff data | Hospital software vendor, lab partner processing on its behalf, cloud host |
| School or coaching centre | Student and parent records (children’s data needs verifiable parental consent) | Learning platform, fee-collection service |
| Fintech or lender | Borrower KYC, credit and repayment data | KYC verification vendor, collection agency acting on its instructions |
| IT or BPO services firm | Its own employees and business contacts | It is usually the Data Processor for client data it handles |
Startups get no automatic exemption. Section 17(3) lets the Central Government notify certain Data Fiduciaries or classes, including startups, to whom section 5, sections 8(3) and 8(7), and sections 10 and 11 shall not apply; until such a notification covers you, the full duties apply. Sector guides: startups, hospitals, fintech, e-commerce and schools.
How will the Perimattic DPDP Compliance Suite help a Data Fiduciary?
Perimattic is building the DPDP Compliance Suite around the duties on this page. Planned features most relevant to a Data Fiduciary:
- A personal-data inventory: what personal data you collect, where it lives and why.
- A processor and vendor register with contract tracking, for section 8(2).
- A breach response workflow for intimations to Data Principals and reports to the Board under Rule 7.
- Retention and erasure schedules under Rule 8, including the 48-hour pre-erasure intimation.
- Data Principal rights requests and grievances with response-time tracking.
- Consent capture and records, with withdrawal as easy as giving consent.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Using it will not by itself make a business compliant, and it is not certified or approved by any government body. Sign up to tell us what personal data you handle.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on the DPDP Act
Data Fiduciaries, answered
Is my company a Data Fiduciary or a Data Processor?
It depends on who decides the purpose and means. If your business decides why personal data is collected and how it is used, you are the Data Fiduciary for that processing. If you only process it on a client’s instructions and for the client’s purpose, you are that client’s Data Processor. Many businesses are both: a fiduciary for their own customers and staff, and a processor for clients.
Has any business been notified as a Significant Data Fiduciary?
Significant Data Fiduciary status comes only from a Central Government notification under section 10 of the Act, made after an assessment of factors such as the volume and sensitivity of data. This page does not list any notified entity. Check the Gazette and MeitY’s website for current notifications before assuming your business is or is not one.
Can a Data Fiduciary pass its DPDP duties to a vendor by contract?
No. Section 8(1) makes the Data Fiduciary responsible for compliance for processing done by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. A contract with the processor is required, and it should carry security and erasure terms, but the legal responsibility stays with the fiduciary.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up