Data Fiduciary vs Data Processor: The Key Distinctions Under the DPDP Act
Under India's Digital Personal Data Protection (DPDP) Act, 2023, every organization that handles personal data falls into one of two roles: data fiduciary or data processor. A data fiduciary decides why and how personal data is processed. A data processor carries out those instructions on the fiduciary's behalf, with no independent decision-making authority. The distinction matters because the DPDP Act ties accountability, liability, and contractual duty directly to which role you occupy.