Glossary
Data fiduciary
The person that decides the purpose and means of processing personal data, and who carries the duties under the Digital Personal Data Protection Act, 2023.
Under section 2(i) of the Digital Personal Data Protection Act, 2023, a data fiduciary is the person who, alone or with others, determines the purpose and means of processing personal data. It is the party the Digital Personal Data Protection Act, 2023 holds responsible. Under section 8(1) a data fiduciary is responsible for complying with the Act for processing done by it or on its behalf by a data processor, irrespective of any agreement to the contrary.
The duties start on one date. Under G.S.R. 843(E) of 13 November 2025, sections 3 to 17 of the Act, which hold the fiduciary's obligations, come into force on 13 May 2027, and so do the rules a fiduciary has to build to: notice under rule 3, security measures under rule 6, breach reporting under rule 7, erasure under rule 8 and a published point of contact under rule 9 of the Digital Personal Data Protection Rules, 2025. Before that date the Act imposes none of these duties. The position is stated as at 13 November 2025.
Used in
- A telemedicine product in India answers to three regulators at once, and only the doctor may prescribe
- Location and driving data from a vehicle telematics device is personal data under the DPDP Act from 13 May 2027
- An AI vendor's indemnity moves the money, not the responsibility: contracts, diligence and disclosure
- The DPDP Rules are notified, and almost nothing in them binds until 13 May 2027
- The DPDP exemption for schools and universities covers tracking and behavioural monitoring, not every use of a student's data
Sources
- ActThe Digital Personal Data Protection Act, 2023 (No. 22 of 2023)meity.gov.inOn this site: The Digital Personal Data Protection Act, 2023
- RulesDigital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, Gazette of India Extraordinary, Part II, Section 3, Sub-section (i), Ministry of Electronics and Information Technologymeity.gov.inOn this site: Digital Personal Data Protection Rules, 2025
- NotificationNotification appointing the dates on which provisions of the Digital Personal Data Protection Act, 2023 come into force, G.S.R. 843(E), 13 November 2025, Gazette of India Extraordinary, Part II, Section 3, Sub-section (i)meity.gov.inOn this site: The Digital Personal Data Protection Act, 2023
Cite this termData fiduciary. Juris Eagle glossary. Stated as at 13 November 2025. https://juriseagle.com/glossary/data-fiduciary