Data Fiduciary
Obligations

A data fiduciary is any person or organization that, alone or with others, determines the purpose and means of processing personal data — broadly equivalent to a controller under the GDPR. If your organization decides why and how digital personal data of people in India is processed, you are a data fiduciary and the obligations in Sections 4–10 of the DPDP Act 2023 apply to you.

A data fiduciary must process personal data only for a lawful purpose, give clear notice, obtain valid consent (or rely on a permitted legitimate use), keep data accurate, apply reasonable security safeguards, erase data once the purpose is served, handle children’s data with verifiable parental consent, and respond to data-principal rights and grievances. Significant Data Fiduciaries carry additional duties under Section 10.

A Significant Data Fiduciary is a data fiduciary the Central Government designates based on factors such as the volume and sensitivity of personal data processed and the risk to data principals or to the sovereignty and security of India. SDFs must appoint a Data Protection Officer based in India, appoint an independent data auditor, and conduct Data Protection Impact Assessments and periodic audits.

Only Significant Data Fiduciaries must appoint a Data Protection Officer, and that DPO must be based in India and report to the board or equivalent. Every data fiduciary, however, must appoint a contact person (or DPO) whose details are published so data principals can raise questions and grievances.

The Data Protection Board can impose penalties of up to ₹250 crore per instance for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data failures, and lower slabs for other defaults. Penalties apply per instance, so one incident touching several obligations can compound.