--- title: "Data Fiduciary: meaning under the DPDP Act" url: https://dpdp.myndsolution.com/wiki/glossary/data-fiduciary/ description: "\"Data Fiduciary\" as defined in section 2(i) of the DPDP Act, 2023: the official definition, its plain meaning, and where the term is used." kind: term updated: 2026-09-09 official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/glossary/data-fiduciary/ --- # Data Fiduciary ## Official definition **Act, s. 2(i):** (i) “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data; ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. The Digital Personal Data Protection Act, 2023 defines a "Data Fiduciary" as any person who decides why and how personal data is processed. If an individual, company, or other entity determines the purpose (the reason for processing) and the means (the methods used for processing) of handling personal data, the law classifies them as a Data Fiduciary. The definition specifically notes that a person can make these decisions "alone or in conjunction with other persons." This means an entity does not have to be the sole decision-maker to be considered a Data Fiduciary. If multiple entities work together to decide the purpose and means of processing personal data, they all fit the definition and carry the responsibilities attached to this role under the Act. ### Key points - A Data Fiduciary is any person who determines the purpose and means of processing personal data (2(i)). - A person can act as a Data Fiduciary entirely on their own (2(i)). - A person can also be a Data Fiduciary when acting together with other persons to make data processing decisions (2(i)). ### Common misreadings - A person might assume they are only a Data Fiduciary if they make data decisions entirely on their own, but the text explicitly includes those who make decisions in conjunction with others. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.* ## Used in - [s. 5 Notice](https://dpdp.myndsolution.com/wiki/act/section-5-notice/) - [s. 6 Consent](https://dpdp.myndsolution.com/wiki/act/section-6-consent/) - [s. 7 Certain legitimate uses](https://dpdp.myndsolution.com/wiki/act/section-7-certain-legitimate-uses/) - [s. 8 General obligations of Data Fiduciary](https://dpdp.myndsolution.com/wiki/act/section-8-general-obligations-of-data-fiduciary/) - [s. 9 Processing of personal data of children](https://dpdp.myndsolution.com/wiki/act/section-9-processing-of-personal-data-of-children/) - [s. 10 Additional obligations of Significant Data Fiduciary](https://dpdp.myndsolution.com/wiki/act/section-10-additional-obligations-of-significant-data-fiduciary/) - [s. 11 Right to access information about personal data](https://dpdp.myndsolution.com/wiki/act/section-11-right-to-access-information-about-personal-data/) - [s. 12 Right to correction and erasure of personal data](https://dpdp.myndsolution.com/wiki/act/section-12-right-to-correction-and-erasure-of-personal-data/) - [s. 13 Right of grievance redressal](https://dpdp.myndsolution.com/wiki/act/section-13-right-of-grievance-redressal/) - [s. 15 Duties of Data Principal](https://dpdp.myndsolution.com/wiki/act/section-15-duties-of-data-principal/) - [s. 16 Processing of personal data outside India](https://dpdp.myndsolution.com/wiki/act/section-16-processing-of-personal-data-outside-india/) - [s. 17 Exemptions](https://dpdp.myndsolution.com/wiki/act/section-17-exemptions/) - [s. 22 Resignation by Members and filling of vacancy](https://dpdp.myndsolution.com/wiki/act/section-22-resignation-by-members-and-filling-of-vacancy/) - [s. 27 Powers and functions of Board](https://dpdp.myndsolution.com/wiki/act/section-27-powers-and-functions-of-board/) - [s. 36 Power to call for information](https://dpdp.myndsolution.com/wiki/act/section-36-power-to-call-for-information/) - [s. 37 Power of Central Government to issue directions](https://dpdp.myndsolution.com/wiki/act/section-37-power-of-central-government-to-issue-directions/) - [s. 40 Power to make rules](https://dpdp.myndsolution.com/wiki/act/section-40-power-to-make-rules/) - [r. 3 Notice given by Data Fiduciary to Data Principal](https://dpdp.myndsolution.com/wiki/rules/rule-3-notice-given-by-data-fiduciary-to-data-principal/) - [r. 6 Reasonable security safeguards](https://dpdp.myndsolution.com/wiki/rules/rule-6-reasonable-security-safeguards/) - [r. 7 Intimation of personal data breach](https://dpdp.myndsolution.com/wiki/rules/rule-7-intimation-of-personal-data-breach/) - [r. 8 Time period for specified purpose to be deemed as no longer being served](https://dpdp.myndsolution.com/wiki/rules/rule-8-time-period-for-specified-purpose-to-be-deemed-as-no-longer/) - [r. 9 Contact information of person to answer questions about processing](https://dpdp.myndsolution.com/wiki/rules/rule-9-contact-information-of-person-to-answer-questions-about/) - [r. 10 Verifiable consent for processing of personal data of child](https://dpdp.myndsolution.com/wiki/rules/rule-10-verifiable-consent-for-processing-of-personal-data-of-child/) - [r. 11 Verifiable consent for processing of personal data of person with disability who has lawful guardian](https://dpdp.myndsolution.com/wiki/rules/rule-11-verifiable-consent-for-processing-of-personal-data-of-person/) - [r. 13 Additional obligations of Significant Data Fiduciary](https://dpdp.myndsolution.com/wiki/rules/rule-13-additional-obligations-of-significant-data-fiduciary/) - [r. 14 Rights of Data Principals](https://dpdp.myndsolution.com/wiki/rules/rule-14-rights-of-data-principals/) - [r. 15 Transfer of personal data outside the territory of India](https://dpdp.myndsolution.com/wiki/rules/rule-15-transfer-of-personal-data-outside-the-territory-of-india/) - [r. 23 Calling for information from Data Fiduciary or intermediary](https://dpdp.myndsolution.com/wiki/rules/rule-23-calling-for-information-from-data-fiduciary-or-intermediary/)