Data Fiduciary
Also called: Significant Data Fiduciary
Under Section 2(i) of the DPDP Act, 2023, any person who alone or with others determines the purpose and means of processing personal data. It bears primary responsibility for compliance.
Explained
Section 2(i) of the Digital Personal Data Protection Act, 2023 defines a Data Fiduciary as any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data. The test is control over the why and how of processing. A Data Processor under Section 2(k) is a person who processes personal data on behalf of a Data Fiduciary, and a Data Principal under Section 2(j) is the individual to whom the data relates, including the parent or lawful guardian of a child or of a person with disability.
Section 8 places the core duties on the Data Fiduciary. Under Section 8(1) it is responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary or any failure of the Data Principal to carry out her duties. It may engage a Data Processor only under a valid contract (Section 8(2)), must ensure completeness, accuracy and consistency of data used for decisions or disclosed to another Data Fiduciary (Section 8(3)), must take reasonable security safeguards to prevent personal data breach (Section 8(5)), must intimate any breach to the Board and to each affected Data Principal (Section 8(6)), and must erase data when consent is withdrawn or the purpose is no longer served, unless retention is required by law (Section 8(7)). Consent obtained under Section 6 must be free, specific, informed, unconditional and unambiguous.
For children, Section 9 requires verifiable consent of the parent before processing, prohibits processing likely to cause a detrimental effect on a child's well-being, and bars tracking, behavioural monitoring and targeted advertising directed at children. Section 10 lets the Central Government notify a Significant Data Fiduciary on factors such as volume and sensitivity of data and risk to electoral democracy; it must appoint a Data Protection Officer based in India and an independent data auditor and carry out periodic impact assessments.
Under Section 13 the Data Fiduciary must provide grievance redressal, and the Data Principal must exhaust it before approaching the Data Protection Board (Section 13(3)). The Board may impose monetary penalties specified in the Schedule under Section 33. Examiners test the definition, Section 9(3) and the exhaustion rule in Section 13(3).
What the law says
(i) “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
Section 2(i): definition of Data Fiduciary
(1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor.
(2) A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract.
(3) Where personal data processed by a Data Fiduciary is likely to be—
General obligations of Data Fiduciary
(1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
Processing of children's personal data
(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including—
(a) the volume and sensitivity of personal data processed;
(b) risk to the rights of Data Principal;
Significant Data Fiduciary obligations
(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.
(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.
(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
Grievance redressal before approaching the Board
Example
Illustration to Section 8(7): X closes her savings account with bank Y. Because banking law requires Y to keep identity records for ten years, Y retains X's personal data for that period.
For the exam
- Section 2(i): the person who determines the purpose and means of processing.
- The Data Fiduciary stays liable for processing done by its Data Processor (Section 8(1)).
- No tracking, behavioural monitoring or targeted ads aimed at children (Section 9(3)).
- A Significant Data Fiduciary must appoint a Data Protection Officer based in India (Section 10(2)).
- Grievance redressal with the Data Fiduciary must be exhausted before the Board (Section 13(3)).
9 questions in the Law Maker question bank use this term. Practise Cyber Law questions
Related terms
- Data PrincipalUnder Section 2(j) of the DPDP Act, 2023, the individual to whom personal data relates, including the parents or lawful guardian of a child and the lawful guardian of a person with disability.
- Personal dataAny data about an individual who is identifiable by or in relation to such data. Section 2(t) of the Digital Personal Data Protection Act, 2023.
- IntermediaryA person who, on behalf of another, receives, stores or transmits an electronic record or provides a service for it, such as an internet provider, search engine or online marketplace. Section 2(1)(w) IT Act.
- Computer resourceComputer, computer system, computer network, data, computer data base or software (Section 2(1)(k) of the Information Technology Act, 2000). It is the widest of the Act's technology terms.
- ChildUnder Section 2(3) of the BNS a child is any person below eighteen years of age. Special statutes use the same age with small variations, and child marriage law sets twenty one for males.
Further reading
Checked 6 November 2026. Statutory text is quoted from the Bare Acts library, taken from India Code. See the full glossary.