Data Fiduciary or Data Processor? Getting DPDP Roles Right in Your Contracts

What is the difference between a data fiduciary and a data processor?

Under the Digital Personal Data Protection Act, 2023, a data fiduciary is any person who alone or in conjunction with other persons determines the purpose and means of processing personal data. A data processor is any person who processes personal data on behalf of a data fiduciary. The individual the data is about is the data principal.

The test is decision-making rather than possession. A vendor holding a large volume of your customer records is a processor if you decide what happens to them and the vendor acts on your instructions. A vendor deciding for its own purposes what to do with data it holds is acting as a fiduciary for that processing, whatever the contract calls it.

The words 'in conjunction with other persons' matter. Two businesses that jointly decide why and how data is used, for example two companies running a co-branded loyalty programme, can each be a fiduciary for that processing. The contract should then say who handles notices, consent and data principal requests.

Why can one company be both?

Take a payroll provider. For your employee data, processed to run your payroll on your instructions, it is a processor and you are the fiduciary. For its own customer relationship with you, including the contact details of your finance team and its own billing records, it decides purposes and means and is a fiduciary.

This is why a single sentence stating that the vendor is a processor is usually inaccurate. Well-drafted terms allocate roles by category of data and activity rather than making one blanket statement, and that granularity is what makes the rest of the clause work.

Common arrangements and the roles they usually involve

The table shows typical positions. Roles depend on the facts of each arrangement, so treat these as a starting point for your own analysis.

What follows from the allocation?

The Act places most duties on the fiduciary. These include giving notice and obtaining valid consent under Sections 5 and 6, taking reasonable security safeguards under Section 8(5), intimating breaches to the Data Protection Board and affected individuals under Section 8(6), erasing data when the purpose is served under Section 8(7), publishing contact details for queries under Section 8(9), and running a grievance mechanism under Section 8(10). Data principals' rights to access, correction, erasure and grievance redressal under Sections 11 to 13 are exercised against the fiduciary.

The processor's obligations come mainly through the contract. Section 8(1) keeps the fiduciary responsible for processing done on its behalf, Section 8(2) permits engaging a processor only under a valid contract, and Section 8(7) requires the fiduciary to cause its processor to erase data. The Rules also treat a contractual obligation on the processor to take security safeguards as part of the fiduciary's reasonable safeguards.

• A processor should be permitted to process only for the stated purposes and on the fiduciary's instructions.
• Security obligations and breach notification need to run from the processor to the fiduciary with a timeline short enough to meet the 72-hour detailed report to the Board.
• Sub-processing needs to be addressed, since most vendors use infrastructure providers of their own.
• Deletion or return on termination, and assistance with data principal requests, belong in the processor's obligations.

Why does getting the role wrong matter?

Because penalties follow the fiduciary. The Schedule to the Act sets maximum penalties of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to notify a breach, imposed by the Data Protection Board. If you are the fiduciary and your processor fails, the Board looks to you, and your recovery from the vendor depends entirely on the contract.

Misallocation also works in the other direction. If a vendor is wrongly treated as a mere processor while it actually uses data for its own ends, nobody gives the individual a proper notice for that use, and the processing may lack a lawful basis from the start.

The clause that is usually missing

Contracts signed before the Rules were notified in November 2025 typically contain a confidentiality clause, sometimes a security schedule, and no allocation of data protection roles at all. Confidentiality and data protection are related but not the same: a confidentiality clause governs disclosure, while the data protection framework governs purpose, security, retention, transfer and the rights of the individual.

The practical fix for existing contracts is a data processing addendum, which many enterprise vendors now have as a standard document because their other customers have asked. For new contracts it belongs in the negotiation rather than as a later amendment.

A useful addendum is short and specific. It lists the categories of personal data and data principals involved, the purposes of processing, the role of each party for each category, the security measures the processor commits to, the breach notification timeline, the approved sub-processors and the process for changing them, where data is stored and whether it can move outside India, how the processor helps with access and erasure requests, and what happens to the data when the contract ends. If a vendor's standard addendum is written for European law, check that it uses the Indian terms and reflects the Indian Act rather than simply relabelling European concepts.

Sample role allocation wording

A clear clause might read: 'For Customer Personal Data processed to provide the Services, Customer is the Data Fiduciary and Vendor is a Data Processor, and Vendor shall process such data only on Customer's documented instructions. For Account Data, meaning contact and billing information of Customer's personnel used to manage the commercial relationship, Vendor is an independent Data Fiduciary. Vendor shall not process Customer Personal Data for any purpose of its own, including analytics, benchmarking or product development, without Customer's prior written consent.'

The last sentence is the safeguard. Without it, a vendor labelled a processor can drift into deciding its own purposes, which changes its role without anyone noticing.

A worked example: a clinic chain and its booking app

A clinic chain with twelve centres uses a booking app supplied by a SaaS vendor at ₹3 lakh a year. Patients book through the app, which stores names, phone numbers, appointment history and symptoms typed into a notes field.

The clinic decides why the data is collected and how it is used: booking, reminders, records. For that data the clinic is the fiduciary and the vendor is a processor. But the vendor's standard terms also let it send patients offers from partner pharmacies, and use appointment data to publish city-level health trends. For those activities the vendor is deciding its own purposes and is acting as a fiduciary, needing its own lawful basis and its own notice to patients.

The clinic's contract called the vendor a processor for everything, so neither party had dealt with the pharmacy offers. Symptom notes are health information that patients expect to be handled carefully, and they were never told of the partner sharing. The fix was an addendum confirming the processor role for booking data, switching off partner marketing, and limiting trend reporting to properly anonymised figures.

Special cases worth knowing

Significant data fiduciaries, notified by the government under Section 10 on factors such as volume and sensitivity of data, carry extra duties: a Data Protection Officer based in India, an independent data auditor and periodic data protection impact assessments. If your customer is one, expect stricter processor terms to flow down to you.

Indian companies processing data of people outside India for foreign clients should look at Section 17, which exempts much of the Act where personal data of data principals outside India is processed in India under a contract with a person outside India. The fiduciary's general responsibility and the duty to take security safeguards are not exempted, so security terms still matter in outsourcing contracts.

Getting it right in your own paperwork

• Map which vendors receive personal data and what they do with it.
• Allocate roles per category of data and activity, not one label per vendor.
• Ask each vendor what it does with usage, telemetry and support data, which is where its own purposes usually appear.
• Where two parties jointly decide purposes, document who gives notice, takes consent and answers requests.
• Sign a data processing addendum with each processor, prioritising those holding sensitive or large volumes of data.
• Where the allocation is genuinely unclear, take advice from an advocate rather than picking the convenient label.