---
title: "Data Processor: meaning under the DPDP Act"
url: https://dpdp.myndsolution.com/wiki/glossary/data-processor/
description: "\"Data Processor\" as defined in section 2(k) of the DPDP Act, 2023: the official definition, its plain meaning, and where the term is used."
kind: term
updated: 2026-09-09
official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
text_type: official-text-plus-interpretation
publisher: MYND Integrated Solutions
license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions.
disclaimer: Not legal advice. Official text prevails over any interpretation.
html_version: https://dpdp.myndsolution.com/wiki/glossary/data-processor/
---
# Data Processor

## Official definition

**Act, s. 2(k):** (k) “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary;


## Interpretation in plain English (not legal advice)

> This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation.

The Digital Personal Data Protection Act, 2023 defines a "Data Processor" as any person who processes personal data on behalf of a Data Fiduciary. A Data Fiduciary is the person or entity that determines the purpose and means of processing personal data. Under this definition, a Data Processor can be an individual, a company, or any other type of person.\n\nThis definition establishes a specific relationship based on who is in charge of the data. The Data Processor does not decide why the personal data is collected or what the ultimate goal of using it is. Instead, the Data Processor only handles, stores, or otherwise processes the personal data because the Data Fiduciary has asked them to do so.\n\nBy drawing the definition this way, the law creates a clear boundary between the entity that controls the data and the entity that merely performs operations on that data. The key factor that makes a person a Data Processor is that their processing activities are done strictly on behalf of a Data Fiduciary.

### Key points

- A Data Processor is defined as any person who processes personal data. [Section 2(k)]
- The processing of personal data by a Data Processor must be done on behalf of a Data Fiduciary. [Section 2(k)]

### Common misreadings

- Assuming a Data Processor decides why data is processed; the text specifies they only process data on behalf of a Data Fiduciary.

*Interpretation prepared 2026-09-09 from the official text only; the official text prevails.*

## Used in

- [s. 6 Consent](https://dpdp.myndsolution.com/wiki/act/section-6-consent/)
- [s. 8 General obligations of Data Fiduciary](https://dpdp.myndsolution.com/wiki/act/section-8-general-obligations-of-data-fiduciary/)
- [s. 11 Right to access information about personal data](https://dpdp.myndsolution.com/wiki/act/section-11-right-to-access-information-about-personal-data/)
- [r. 6 Reasonable security safeguards](https://dpdp.myndsolution.com/wiki/rules/rule-6-reasonable-security-safeguards/)
- [r. 8 Time period for specified purpose to be deemed as no longer being served](https://dpdp.myndsolution.com/wiki/rules/rule-8-time-period-for-specified-purpose-to-be-deemed-as-no-longer/)