What is DATA Fiduciary
With the implementation of the Digital Personal Data Protection (DPDP) Act, 2023, businesses across India are becoming more aware of their responsibilities regarding the collection and processing of p
What is a Data Fiduciary? Who is a Data Fiduciary Under the DPDP Act, 2023?
Introduction
With the implementation of the Digital Personal Data Protection (DPDP) Act, 2023, businesses across India are becoming more aware of their responsibilities regarding the collection and processing of personal data. One of the most important concepts introduced by the Act is the Data Fiduciary.
If your business collects customer information through websites, mobile applications, registration forms, social media campaigns, WhatsApp inquiries, or any other digital channel, you may be considered a Data Fiduciary under the DPDP Act.
In this article, we will explain what a Data Fiduciary is, who qualifies as one, and what responsibilities come with this role.
What is a Data Fiduciary?
A Data Fiduciary is any person, company, organisation, government body, or entity that determines the purpose and means of processing personal data.
In simple terms, a Data Fiduciary decides:
Why personal data is being collected.
- What personal data is required.
- How the data will be used.
- How long the data will be stored.
- With whom the data may be shared.
The Data Fiduciary is responsible for ensuring that personal data is handled lawfully, securely, and transparently.
Who is a Data Principal?
Before understanding Data Fiduciaries, it is important to know about the Data Principal.
A Data Principal is the individual whose personal data is being collected or processed.
Example:
- Customer filling out a contact form → Data Principal
- Employee submitting personal details → Data Principal
- Student registering for an online course → Data Principal
The organisation collecting this information becomes the Data Fiduciary.
Who Can Be a Data Fiduciary?
Many businesses and organisations qualify as Data Fiduciaries.
Examples include:
- E-commerce Companies
Online stores collecting customer names, addresses, phone numbers, and payment details.
- Hospitals and Healthcare Providers
Organisations collecting patient records and medical information.
- Educational Institutions
Schools, colleges, and coaching centers collecting student information.
- Financial Institutions
Banks, NBFCs, insurance companies, and fintech platforms processing customer data.
- IT and SaaS Companies
Software providers collecting user registrations and account information.
- Marketing Agencies
Businesses collecting leads through websites, advertisements, and campaigns.
- Government Organisations
Departments and agencies processing citizen data.
If your business collects personal information from customers, employees, vendors, or website visitors, you are likely acting as a Data Fiduciary.
Responsibilities of a Data Fiduciary
Under the DPDP Act, Data Fiduciaries have several important obligations.
1. Obtain Valid Consent
Personal data should generally be collected after obtaining clear and informed consent from the individual.
2. Provide Notice
Individuals should be informed about:
- What data is being collected.
- Why it is being collected.
- How it will be used.
- How they can exercise their rights.
3. Ensure Data Security
Organisations must implement reasonable security measures to protect personal data from unauthorized access, misuse, breaches, or theft.
4. Maintain Data Accuracy
Collected information should be accurate and updated whenever necessary.
5. Delete Data When No Longer Required
Personal data should not be retained indefinitely and must be deleted when the purpose for processing is fulfilled.
6. Respond to User Requests
Data Principals have rights related to their personal information. Data Fiduciaries must have mechanisms to address such requests.
7. Report Data Breaches
In the event of a data breach, the organisation may be required to notify the appropriate authorities and affected individuals.
What is a Significant Data Fiduciary?
The Government of India may classify certain organisations as Significant Data Fiduciaries (SDFs) based on factors such as:
- Volume of personal data processed.
- Risk to individuals' rights.
- Impact on national interests.
- Use of sensitive technologies.
Significant Data Fiduciaries may have additional compliance requirements, including audits, risk assessments, and appointment of designated compliance officers.
Examples of Data Fiduciaries
Business Type |
Data Collected |
Data Fiduciary? |
|
E-commerce Website |
Customer Information |
Yes |
|
Hospital |
Patient Records |
Yes |
|
School |
Student Data |
Yes |
|
Insurance Company |
Policyholder Information |
Yes |
|
SaaS Platform |
User Registration Data |
Yes |
|
Marketing Agency |
Lead Information |
Yes |
How Can Businesses Become DPDP Compliant?
To comply with the DPDP Act, organisations should:
- Implement a Consent Management System.
- Maintain audit logs and records.
- Publish a privacy policy.
- Establish data retention practices.
- Secure customer information.
- Create grievance redressal mechanisms.
- Conduct regular compliance reviews.
Using a dedicated consent management platform can significantly simplify these requirements.
Conclusion
A Data Fiduciary is any organisation or individual that decides how and why personal data is processed. Under the DPDP Act, 2023, businesses that collect and use personal information have a legal responsibility to protect that data and respect the rights of individuals.
Whether you run an e-commerce website, healthcare facility, educational institution, startup, or service-based business, understanding your role as a Data Fiduciary is essential for achieving DPDP compliance and building customer trust.
Need Help with DPDP Compliance?
Consent Server helps organisations manage consent, maintain audit records, strengthen data security, and simplify compliance with India's DPDP Act, 2023.
Contact us today to learn how your business can become DPDP compliant efficiently and effectively.
