Data Fiduciary

What is a Data Fiduciary?

The Digital Personal Data Protection Act of 2023 (DPDPA) is India’s first cross-sectoral law for personal data protection. It recognizes certain rights of individuals over their personal data and imposes various obligations on organizations using or seeking to collect, use, store, share, handle, or otherwise carry out any operations in relation to that data. To operationalize those rights against and target those obligations on relevant organizations vis-à-vis particular sets of data, the DPDPA defines the concept of a "Data Fiduciary".

A "data fiduciary" is an individual or organization entrusted with the custody, control or management of personal data in a relationship of trust, akin to more traditional fiduciary relationships (for example, between a lawyer and a client, or a physician and a patient). In practice, this means that a data fiduciary is not just someone who collects or processes data mechanically, but a custodian or steward of personal information, as they carry responsibilities including but not limited to; determining why and how data is processed, ensuring lawful and fair handling, minimizing risks of misuse, and maintaining transparency and accountability toward data-subjects.

The need for this definition arises from the fact that, in practice, activities involving the use of personal data often involve multiple actors performing different roles, functions, or services, and not all will have the same degree of responsibility or decision-making power.

Before being defined in the DPDPA, the term 'Data Fiduciary' can be traced to 'Information Fiduciary', introduced by legal scholar Jack Balkin in a 2014 essay and formalized in his 2016 UC Davis Law Review article.

Balkin defined it functionally, using the analogy of existing professional fiduciaries: someone who, because of their relationship with another, assumes special duties with respect to the information they obtain in the course of that specific relationship. He built this on the observation that in the law, a fiduciary is a person or business with an obligation to act in a trustworthy manner in the interest of another, and just as doctors, lawyers, and accountants are examples of information fiduciaries, fiduciaries are obligated to keep confidences and never use client information against the client's interest. With this analogy, Balkin argued digital platforms occupy structurally the same position toward users.

The mechanism he pointed to is asymmetric dependence. Clients cannot easily observe and monitor what professionals do and are dependent on professional expertise. Furthermore, professionals expect and encourage clients to have confidence in them. So the definition isn't about what data is collected, it's about the relationship. Whoever holds an informational advantage and invites reliance takes on a duty not to exploit that advantage.

Balkin embraced the idea of information fiduciaries and argued that "Because of their special power over others and their special relationships to others, information fiduciaries have special duties to act in ways that do not harm the interests of the people whose information they collect, analyze, use, sell, and distribute. These duties place them in a different position from other businesses and people who obtain and use digital information."

Official definition of Data Fiduciary

Data Fiduciary as defined in Legislation(s)

Information Technology Act, 2000

To understand the interpretation of Data Fiduciary under DPDPA, it is important to also look into how actor that now take the designation of Data Fiduciary were first distinguished under Information Technology Act, 2000, before India had its own independent digital protection and data privacy law.

Data protection was brought about into the IT Act through the 2008 Amendment, which inserted Section 43A. This section required reasonable security practices by a body corporate that possesses or deals with sensitive personal data or information, with liability for damages if negligence causes wrongful loss. The term “body corporate” is not limited to companies and includes “a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.” Arguably, most entities that are undertaking any commercial or professional activities can be brought within this definition and can be held liable under this rule.

Further, Section 72A provides for the punishment for disclosure of information in breach of lawful contract and any person may be punished with imprisonment for a term not exceeding three years, or with a fine not exceeding up to five lakh rupees, or with both in case disclosure of information is made in breach of lawful contract.

Digital Personal Data Protection Act, 2023

Under the Digital Personal Data Protection Act, 2023 (India), Section 2(i) defines Data Fiduciary as: "Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data". Data Fiduciary is a person who ascertains the purpose and means of processing personal data. Under this framing, a data fiduciary has an ethical and often legal responsibility to act in the best interests of the 'data principal', rather than merely as a commercial counterparty or neutral technical processor.

Interpretation of the Definition of Data Fiduciary under DPDPA, 2023

Understanding the interpretation, application, and operation of the definition of a “Data Fiduciary” requires reading Section 2(i) together with several other definitions in the DPDPA, which are highlighted below:

Processing of Personal Data

Sections 2(t) and 2(x) of the DPDPA define the terms ‘personal data’ and ‘processing’, respectively. While personal data is data about a specific individual that can be used to identify that individual, processing is a broad term used to capture any kind of activity involving, or operation performed on, that personal data. It means that a ‘Data Fiduciary’ is a role defined in relation to a particular set of personal data and of processing operations involving that data in particular; it is not a context-agnostic or static concept that applies at an organisation-wide level or across all types of data handled by an organisation. An organisation’s role can vary across different types of personal data processed by it.

Person

Section 2(s) of the DPDPA defines the term “person” as inclusive of any individual, any ‘artificial juristic persons’ (including a company, a partnership firm, or a Hindu Undivided Family) as well as the “State” - which means that any of the above can be regarded as a “Data Fiduciary” in relation to particular personal data.

Section 2(zb) further defines the term “State” by referring to Article 12 of the Constitution of India. This implies that the “Data Fiduciary” can be interpreted to apply to any agency, authority or organization that can be regarded as the “State” under Article 12.

Legal Provisions Relating to Data Fiduciary under DPDPA, 2023

General Obligations of Data Fiduciary

Chapter II deals with General Obligations of Data Fiduciary during data processing, which are highlighted below.

Grounds for Processing Personal Data

Section 4 permits the processing of personal data only in accordance with the Act and strictly for a lawful purpose, meaning any purpose not expressly prohibited by law. Such processing is allowed either when the Data Principal has given valid consent or when the activity qualifies as one of the Act’s specified legitimate uses.

Notice to Data Principal

Section 5 requires the Data Fiduciary to give a clear notice to the Data Principal before seeking Consent. The notice shall lay out clearly the personal data to be collected, the purpose of its processing, the manner in which the Data Principal can exercise their rights (such as withdrawing consent or accessing her data), and how they may lodge a complaint with the Data Protection Board. If a person had already given consent before the Act came into force, the Data Fiduciary must later issue the same notice, as soon as reasonably possible, informing the individual about the data being processed, her rights, and complaint mechanisms.

Consent Requirements

Section 6 mandates that consent must be free, informed, specific, given through a clear affirmative action, limited only to data necessary for the stated purpose, capable of being withdrawn by Data Principal, and any part of consent that violates the Act or any other law is invalid. After withdrawal, the Data Fiduciary and its Data Processors must stop processing the data unless further processing is legally required. Consent may be given, managed, reviewed, or withdrawn through a registered Consent Manager, who is accountable to the Data Principal and must act on her behalf as per prescribed obligations.In any dispute about consent, the Data Fiduciary bears the burden to prove that proper notice was given and valid consent obtained.

Processing of Personal Data of Children

Section 9mandates Data Fiduciaries to obtain a verifiable consent from a child’s parent/lawful guardian before processing the child’s personal data, while ensuring that the processing carried out does not harm the child’s well-being. They are further prohibited from tracking, behaviourally monitoring, or targeting advertisements at children. However, the government may prescribe specific classes of Data Fiduciaries or purposes where the requirements of sub-secs (1) and (3) do not apply. Moreover, if a Data Fiduciary demonstrates that its processing of children’s data is verifiably safe, the Central Government may notify an age threshold beyond which that Data Fiduciary may be exempted from obligations under sub-secs (1) and (3), as specified in the notification.

Specific Compliance Duties of Data Fiduciary

Section 8 provides for duties or operational responsibilities that Data Fiduciaries must follow while carrying out processing of Data.

1. A Data Fiduciary is fully responsible for complying with the Act, even if the Data Principal fails in their duties or even if the data is processed by a Data Processor on its behalf. A Data Fiduciary may hire a Data Processor, but only through a valid contract and only for offering goods or services.
2. When personal data is used for decisions affecting the Data Principal or shared with another Data Fiduciary, the Data Fiduciary must ensure the data is complete, accurate, and consistent. It must also implement proper technical and organisational safeguards to ensure compliance, and take reasonable security measures to prevent breaches.
3. If a personal data breach occurs, the Data Fiduciary must notify both the Data Protection Board and every affected Data Principal as prescribed.
4. A Data Fiduciary must delete personal data once consent is withdrawn or when the purpose is no longer served, whichever comes earlier, unless a law requires longer retention. It must also ensure that its Data Processor deletes the data provided to it.
5. The purpose is assumed to no longer be served when the Data Principal neither engages with the Data Fiduciary for that purpose nor exercises any related rights for a prescribed period.
6. A Data Fiduciary must publish the contact details of its Data Protection Officer (if applicable) or another authorized person to answer Data Principal queries. It must also establish an effective grievance-redressal mechanism.

Significant Data Fiduciary (SDF)

It is worth noting that the DPDPA distinguishes between ‘Data Fiduciaries” and “Significant Data Fiduciaries” (SDF). Section 5 of the DPDPA defines a Significant Data Fiduciary as a fiduciary who processes personal data and:

1. Has significant volume of personal data, or
2. Uses personal data for decision-making that impacts data principals significantly, or
3. Uses data of sensitive nature, or
4. Is a key information infrastructure operator, or
5. Processes data in combination with other personal data that the fiduciary has processed in the past or processes currently.

As per Section 10(1) of the DPDPA, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as an SDF. This notification is given out after weighing in specific factors such as the volume and sensitivity of personal data processed, risk of harm to the Data Principal, potential impact on sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order, plus any other factors it considers necessary. Upon notification, SDFs are subject to additional obligations specified in section 10(2), which they must comply with over and above all the obligations that are applied on Data Fiduciaries in general. This distinction is intended to bring in flexibility under the DPDPA, where obligations may be asymmetrically imposed on organisations based on the potential risks and harms associated with different data processing operations.

Digital Personal Data Protection Rules, 2025

Digital Personal Data Protection Rules, 2025, do not define Data fiduciary but they change the role from a principle-based statutory entity into an operationally regulated one.

Legal Provisions Relating to Data Fiduciary under DPDP Rules, 2025

Notice by Data Fiduciary

DPDP Rules, 2025, prescribe how a Data Fiduciary must issue notice to a Data Principal, something that the DPDP Act, 2023 had left open by using the phrase “in such manner as may be prescribed”. Rule 3 states that the notice issued shall be understandable on its own, presented independently of any other information, must contain a clear and plain account of the personal data being processed, including an itemised description of such data and the specific purposes for which it is processed, along with the goods or services enabled by such processing. It further obligates the Data Fiduciary to provide a specific communication link to its website or application, through which the Data Principal can withdraw consent, exercise her rights under the Act, and make a complaint to the Data Protection Board.

Time Period for Retention and Erasure of Personal Data

Rule 8(1) states that a Data Fiduciary belonging to specified classes must erase personal data after the expiry of the corresponding time period mentioned in the Third Schedule, provided the Data Principal has neither approached the Data Fiduciary nor exercised her rights during that period. It also mandates that the Data Fiduciary must inform the Data Principal, at least 48 hours before such erasure, that her data will be erased unless she initiates contact or exercises her rights. Additionally, the Rule requires the Data Fiduciary to retain personal data, associated traffic data and processing logs for a minimum period of one year for purposes specified in the Seventh Schedule.

Contact Information of Person Answering Queries

Rule 9 of the DPDP Rules, 2025 strengthens the obligation given in Section 8(9) of the DPDP Act, 2023, which requires a Data Fiduciary to publish the business contact information of a Data Protection Officer or another authorized person. It obligates the Data Fiduciary not only to prominently publish such contact information on its website or application, but also to mention it in every response to a communication made by a Data Principal for the exercise of her rights.

Verifiable Consent for Processing Personal Data of Children

The DPDP Act, 2023 imposes the obligation of obtaining verifiable parental consent for processing personal data of children but do not specify how such consent would be verified. The DPDP Rules, 2025 fill this gap by prescribing mechanisms for obtaining verifiable consent. The Rules 10 and 11 obligates the Data Fiduciary to adopt appropriate measures to verify that consent is given by the parent or lawful guardian, and they recognise specific lawful means for such verification.

Exemptions for Certain Data Fiduciaries Processing Children’s Data

Rule 12 provides exemptions from certain obligations under section 9 of the Act for specific classes of Data Fiduciaries and purposes listed in the Fourth Schedule. These exemptions apply only subject to conditions specified in the Schedule, providing a rule-level clarification of section 9(4) of the Act and is significant because it legally recognises that not all Data Fiduciaries processing children’s data are treated uniformly, provided they satisfy the prescribed conditions.

Additional Obligations of Significant Data Fiduciaries

Rule 13 requires a Significant Data Fiduciary [SDF] to conduct a Data Protection Impact Assessment, an audit at least once every 12 months and to ensure that the person carrying out such assessment submits a report to the Data Protection Board. It also imposes due diligence obligations regarding technical measures, including algorithmic software, to ensure that such measures do not pose a risk to the rights of Data Principals. Furthermore, it introduces a conditional restriction on cross-border transfer of specified personal data, subject to directions of the Central Government.

Breach of SDF obligations under Section 10 attracts penalties up to ₹150 crore.

Rights of Data Principal

Rule 14 places an express obligation on Data Fiduciaries to publish, on their website or application, the means through which Data Principals may exercise their rights and the particulars required for identification. It also mandates that grievances be responded to within a reasonable period not exceeding ninety days.

Data Fiduciary as defined in International Instruments

General Data Protection Regulation (GDPR), European Union

The General Data Protection Regulation (GDPR), effective since 2018, is one of the most comprehensive data protection laws globally, and it defines the "Controller" similarly to the Data Fiduciary under India’s DPDPA. The regulation offers extensive rights to individuals regarding their personal data. Article 4(7) of the GDPR defines a controller as “means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law”. This matches the definition under section 2(i) of the DPDPA.  

Article 4(8) of the GDPR defines Processor as "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller".

Responsibility and Accountability of the Controller

Article 24 GDPR makes the controller responsible for ensuring that personal data is processed in accordance with the GDPR and for being able to demonstrate that such processing is compliant. Reference could be made to the accountability principle in Article 5(2) GDPR, which states that the controller is responsible for compliance with the data protection principles in Article 5(1) and must be able to demonstrate such compliance. Together, these provisions establish that the controller is the primary addressee of GDPR obligations and carries both operational responsibility and evidentiary burden.

Furthermore, Recital 74 establishes that the controller bears responsibility and liability for all processing of personal data, whether the processing is carried out directly by the controller or on its behalf. To discharge this responsibility, the controller is required to put in place measures that are appropriate and effective, and must also be capable of demonstrating that its processing activities comply with the Regulation, including showing that such measures function in practice. In determining these measures, due regard must be given to the nature, scope, context and purposes of the processing, as well as the level of risk posed to the rights and freedoms of natural persons.

Appropriate Technical & Organisational Measures

Under Article 24, the controller must implement technical and organisational measures that are appropriate having regard to the nature, scope, context and purposes of processing and the risks to the rights and freedoms of natural persons. Technical and Organisational Measures are controls that reduce the likelihood or impact of a data breach. The term covers both technological solutions and the administrative processes that support them.

The Measures are meant to protect from two types of attacks, namely:

Technical threats: Malicious events or activities designed to exploit system vulnerabilities and compromise data. Examples of this range from typical malware or ransomware, to DDoS attacks.

These are offset by TOMs such as protective software and encryption.

Human-centric threats: Cyberattacks and security risks that actively target human psychology, behavior, and daily communication channels rather than traditional IT infrastructure. Social engineering, phishing, deep fake impersonation, etc. are examples of these.

These are offset by TOMs such as awareness training and sensitization, as well as risk assessments.

Article 25 GDPR requires the controller to apply data protection by design and by default, meaning that safeguards must be integrated into processing systems and practices from the outset.

Article 32 GDPR requires the controller to ensure a level of security appropriate to the risk, including measures such as confidentiality, integrity and resilience of systems. These Articles together clarify that the controller’s duty is preventive, risk-based and continuous rather than static or formalistic.

Compliance and Support Mechanism

Article 24(3) GDPR allows the controller to rely on adherence to approved codes of conduct under Article 40 GDPR, which provides for sector-specific rules approved by supervisory authorities, and approved certification mechanisms under Article 42 GDPR, which provide voluntary compliance certifications. These mechanisms may be used as elements to demonstrate compliance but do not replace the controller’s independent responsibility. The controller remains fully accountable even where such mechanisms are relied upon.

European Data Protection Board (EDPB)

While the GDPR itself does not formally define either term, we note that the European Data Protection Board (EDPB), which is considered an authoritative source of guidance on European data protection law, has issued guidance in 2020 of relevance. They note that:

“Determining the purposes and means amounts to deciding respectively the “why” and the “how of the processing: given a particular processing operation, the controller is the actor who has determined why the processing is taking place (i.e., “to what end”; or “what for”) and how this objective shall be reached (i.e. which means shall be employed to attain the objective).”

From the above, we can note that, in simple terms, for the EDPB, the data controller will be that actor who determines the ‘why’ and ‘how’ of a processing operation. This provides an indication of how the definition of a ‘data fiduciary’ may be interpreted in India as well. It is also worth noting that the DPDPA was introduced to replace a framework under the Information Technology Act of 2000 (IT Act), namely, section 43A read with the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. Under that framework, entities processing personal data were identified using the term “body corporate”. This indicated that the earlier IT Act framework was limited to the private sector. The relevance of the term “data controller” from European data protection law also emerges from the legislative and policymaking history of the process of drafting a data protection law for India.

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)

The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (2013) were among the first international efforts to establish a framework for safeguarding personal data while allowing its free flow across borders. These guidelines have formed the basis for privacy laws globally and have been periodically updated to reflect evolving standards. The Accountability Principle is the eighth and final principle in the OECD's Guidelines, and it functions differently from the rest as it acts to make the other seven principles enforceable. The other seven principles (Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation) describe what should happen to personal data, but don't govern what will happen if these principles are not followed through with.

The Accountability Principle states that "A data controller should be accountable for complying with measures which give effect to the principles stated above". This definition is deliberately vague to ensure the data controllers are answerable for actions beyond their intentions and places the focus on the outcomes of their actions.

Asia-Pacific Economic Cooperation (APEC) Privacy Framework, 2005

The APEC Privacy Framework uses the term 'Personal Information Controller' (PIC) to define a body that collects personal information. This is a deviation to the fiduciary relation analysed so far. A fiduciary means a duty to the person information is taken from, whereas a controller means duty to follow stated rules.

Personal Information Controller means a person or organization who controls the collection, holding, processing, use, disclosure or transfer of personal information. It includes a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf, but excludes a person or organization who performs such functions as instructed by another person or organization.

Principle IX in APEC's 9-principle structure, borrows from the Accountability Principle in OECD's 8-principle structure. It requires a personal information controller to be accountable for complying with measures that give effect to the Principles. When transferring personal information, reasonable steps should be taken to ensure recipients protect the information consistently with the framework. Further, following an update in 2015, the principle requires that a data controller be accountable for complying with measures that give effect to the nine principles. When transferring personal information to another person or organisation, whether domestically or internationally, this principle states the controller should either obtain consent of the individual or exercise due diligence to ensure that recipients also protect the information in a manner that is consistent with the principles. Obtaining consent or conducting such due diligence is not required when domestic laws require disclosures of personal information.

Data Fiduciary as defined in Official Documents

Justice A.P Shah Committee, 2011

The first effort to evolve a personal data protection framework for India was undertaken in 2011 by the A.P. Shah Committee, formally known as the Group of Experts on Privacy. In their report, the A.P. Shah Committee used the term “data controller” throughout the report and especially when framing various privacy principles. The fundamental philosophy underlining these principles was the need to hold the data controller accountable for the collection, processing and use to which data is put, thereby ensuring that the privacy of the data subject is protected. The principles placed an obligation on all public and private data controllers to put in place safeguards and procedures that would enable and ensure these protections and rights, and were meant to apply to any information concerning an identified or identifiable natural person.

A reading of their report indicates that, though they did not formally define the concept of a ‘data controller’, they were referring to and relying on the European conception of the term, which would be an entity that determines the purposes and means of processing personal data, and that consequently bears accountability for compliance. This was an explicit borrowing, as the report drew on and compared itself against the EU Data Protection Directive, the OECD Guidelines, the APEC framework, and the (then-new) EU Data Protection Regulation of January 2012, citing features such as the accountability of data controllers by requiring that personal data be processed under the responsibility and liability of the controller, with the data controller also responsible for compliance with the Regulation. By using this term, the AP Shah Committee underscored the need for a formal legal concept to attach obligations relating to personal data protection to specific entities that were using personal data – which is the role performed by the definition of a “Data Fiduciary” in the DPDPA today.

The practical obligations the Committee attached to this figure were extensive and read very much like a proto-fiduciary regime. A data controller was expected to, among other things:

1. Give simple-to-understand notice of its information practices to individuals, in clear and concise language, before collecting any personal information, including contact details of privacy officers and details on any changes to the data controller's privacy policy.
2. Take individual consent only after providing notice, and allow the data subject to withdraw consent at any time.
3. Collect only personal information necessary for the identified purpose, and process data only as relevant to that purpose.
4. Use collected data only for the purpose for which it was collected, obtaining fresh consent for any change in use.
5. Be subject to oversight by Privacy Commissioners, who could impose fines on data controllers found in contravention of the national privacy principles and order privacy impact assessments.

Justice BN Srikrishna Committee Report, 2018

The term “Data Fiduciary” was coined by the Committee of Experts on a Data Protection Framework for India (Srikrishna Committee), established in 2017 by the Ministry of Electronics and Information Technology, Government of India pursuant to the Puttuswamy judgment which recognised the fundamental right to privacy. The Srikrishna Committee, tasked with developing a personal data protection law for India, released a draft Personal Data Protection Act of 2018 (PDP 2018), which used the term “Data Fiduciary” for the first time. In their accompanying report, the Srikrishna Committee justified using the term “data fiduciary” instead of the term “data controller” to emphasize the trust-based relationship between the individual being identified by the personal data (i.e., the “data principal”) and the entity using their data (i.e., the “data fiduciary”). The Committee felt that the former term better reflects a fiduciary responsibility to act in the best interests of data principals.

It identified data fiduciary as an entity which, in the digital economy, handles personal data in circumstances where data principals place varying degrees of trust and loyalty in it, depending on the nature of the data shared, the purpose of such sharing, and the entities with whom the data is shared. This relationship of trust imposes a duty of care on the entity to process and deal with the data fairly, responsibly, and only for purposes that the data principals can reasonably expect, thereby placing the entity in a fiduciary position vis-à-vis the data principal.

The Committee framed the fair-and-reasonable-processing principle as addressing three concerns:

1. Power asymmetries between data subjects and data fiduciaries- recognizing that data fiduciaries have a responsibility to act in the best interest of the data principal;
2. Situations where processing may be legal but not necessarily fair or in the best interest of the data principal; and
3. Developing trust between the data principal and the data fiduciary.

This was explicitly framed in contrast to the GDPR, which requires processing to simultaneously meet only the three conditions of fairness, lawfulness, and transparency.

A retrospective analysis of the Act can lead to the underlying idea more directly: the concept deliberately borrows from trust law, where a fiduciary is someone who holds power over another's interests and is bound to exercise that power in the interest of the beneficiary. By calling data controllers 'fiduciaries', it signals a heightened duty of care, not merely compliance with rules, but a genuine obligation to act in the Data Principal's interest.

The obligations the Committee attached to this status followed the same logic as the earlier A.P. Shah Committee's data controller obligations, but recast as fiduciary duties. A data fiduciary had to provide adequate notice before collection, was subject to a modified consent framework carrying product-liability-style consequences for harm to the data principal, and bore duties around accuracy, security, breach notification, and purpose limitation. The Bill provided that the data fiduciary has to provide the data principal with adequate notice before collection of personal data, and the modified consent framework applied a product liability regime to consent, making the data fiduciary liable for harms caused to the data principal.

Not everyone found the trust framing convincing on its own terms. The Centre for Communication Governance at NLU Delhi, in its comments on the 2018 draft, noted a tension in how the Committee actually deployed the concept. While appreciating the Committee's acknowledgment of the expectation of trust an individual has from a data fiduciary, the Report's discussion of the concept ultimately refocuses on the idea of a free and fair digital economy by stating that data fiduciaries must only be allowed to share and use personal data to fulfil the expectations of the data principal in a manner that furthers the common public good of a free and fair digital economy. The critique, in effect, was that the fiduciary language promised an individual-facing duty of loyalty but the operative standard kept sliding back toward a collective, economy-facing justification. This tension persists in how "deemed consent" and "legitimate uses" are handled in the eventual DPDPA.

TRAI's Consultation Paper

According to Telecom Regulatory Authority of India's consultation paper on "Regulatory Framework for Promoting Data Economy Through Establishment of Data Centres, Content Delivery Networks, and Interconnect Exchanges in India" describes Data Fiduciary as an "entity or an individual who decides the means and purpose of processing personal data." However this processing is subjected to a certain purpose, collection, and storage limitations. It also provides for obligations that all data fiduciaries must undertake some measures to maintain transparency and accountability such as:

1. Implementing security safeguards (such as data encryption and preventing misuse of data)
2. Instituting grievance redressal mechanisms to address complaints of individuals etc.

The definition of Data Fiduciary, as given in the paper, tracks the operative language used in the PDP Bill 2019 and was later carried into Section 2(i) of the DPDPA, 2023 almost verbatim. This traceability of the definition's origin can help lay down the core test for who counts as a Data Fiduciary ( that being the "purpose and means" determination) as it remained stable across at least four legislative and quasi-regulatory iterations, such as the 2018 PDP Bill, the 2019 PDP Bill, TRAI's 2021 consultation paper, and the enacted 2023 Act.

The placement of "Data Fiduciary" obligations inside a 'data-centre-and-infrastructure' consultation paper also goes to show the methodology and approach of TRAI when analysing data privacy, protection and responsibilities that revolve around data. Data centres, CDN operators, and IXPs can be said to be treated as potential Data Fiduciaries (or at minimum, entities operating in close proximity to fiduciary obligations), going beyond physical/technical infrastructure providers, whenever they process personal data flowing through their facilities. This approach seems to foreshadow later debates about where colocation providers, cloud hosts, and infrastructure intermediaries sit on the fiduciary/processor line under the DPDPA.

International Experiences

As discussed above, the concept of a ‘data controller’ used in many other jurisdictions is a key reference point for interpreting and applying the definition of a “Data Fiduciary”. Both concepts are similarly defined using the “purpose and means” test. In addition, two other useful international reference points are:

Singapore

Under the Singaporean Personal Data Protection Act of 2012 (SPDPA), the equivalent of the term “Data Fiduciary” is the term “organisation”, which is defined as including any ‘individual, company, association or body of persons, corporate or unincorporated’. Instead of the ‘purpose and means’ test, obligations apply to organisations based on the specific data processing activities performed by them in question – that is, some obligations apply to the activities of collection or disclosure, while others apply to storage or transfers. The SPDPA term is a similarly wide definition as that of a ‘Data Fiduciary’ to the extent that both capture the private sector exhaustively. However, the Singaporean term does not capture the State, a key difference from the DPDPA term. This is because the SPDPA only applies to the private sector.

Core Obligations

Under Sections 11-20 of the PDPA, organisations must comply with the following core obligations:

1. Consent Obligation - Before collection, usage or disclosure of personal data and stop processing if consent is withdrawn.
2. Purpose Limitation - Collection, usage or disclosure of personal data reasonable person would consider appropriate and that have been communicated to the individual.
3. Notification Obligation - Providing information to the individuals the purpose for collection, usage or disclosure of personal data.
4. Accuracy Obligation - Ensuring the accuracy and wholeness of personal data.
5. Protection Obligation - Requires Organisations to make reasonable security arrangements for the protection of personal data.

Limitations

Under Sections 21 and 22 of PDPA, organisations must provide individuals with access to their personal data and allow corrections to inaccurate information. Section 25 of PDPA puts up a retention limitation that organisations retaining personal data must cease it when the data is no longer needed for the purpose (for which it was originally collected). Additionally, Section 26 of PDPA ensures that personal data transferred outside Singapore is afforded comparable standards of protection.

Reed v. Bellingham (Attorney-General, Intervener) [2022] SGCA 60

This is Singaporean case further analysed the definition of "organisation" to rule on whether it included an individual or not. The Court of Appeal rejected the respondent's arguments that PDPA obligations applied only to "organisations" in their traditional sense, and not to the respondent as an individual, pointing out that the definition of "organisation" under the PDPA expressly includes an individual. An individual acting outside an employment relationship is himself an "organisation" for PDPA purposes

California

Under the Californian Consumer Privacy Act of 2018 (CCPA), the equivalent is the term “business”, which is defined as any for-profit entity that does business in California, collects consumers’ personal data and meets certain qualifying thresholds. Businesses meeting these thresholds must comply with the obligations under the CCPA as applicable to their services and/or business activities. The CCPA is a narrower definition than that of a ‘Data Fiduciary’ under the DPDPA due to these qualifying thresholds; consequently, the CCPA does not apply to the entirely of the private sector as the default. It also does not capture the State, another key difference from the DPDPA term.

Courts have converged on reading Cal. Civ. Code § 1798.140(d)(1) defines a "business" under the CCPA as a two-part test. To be deemed a "business" under the CCPA, an entity must:

1. Collect personal information and
2. Determine why and how that personal information should be processed.

Australia

Australia’s Privacy Act of 1988  has been a cornerstone of personal data protection in the country and aligns with the rights of Data Principals through its Australian Privacy Principles (APPs). These principles govern how organizations should handle personal information, with specific rights for individuals.

Australia's Privacy Act draws inspiration from Fair Information Practice Principles (FIPPs), which are a substantive ancestor of modern data protection law, including the Australian Act. Originated in the 1973 US HEW report 'Records, Computers and the Rights of Citizens', then codified in the OECD Privacy Guidelines (1980) and Council of Europe Convention 108 (1981). These establish a rule-based relationship model, unlike a fiduciary one and implements guidelines regarding notices, purpose limitations, use limitations, access/correction rights, etc. Australia's 1988 Act draws directly on this OECD lineage, instead of taking inspiration from fiduciary theory.

Title	Purpose
APP 1: Open and Transparent Management	An APP entity must take reasonable steps to implement practices, procedures and systems that ensure compliance with the Privacy Act and the APPs. It must also maintain a privacy policy explaining how personal information is managed.
APP 3: Collection of Solicited Information	Restricts collection of personal information to what is reasonably necessary for the entity’s functions or activities. Collection must be lawful and fair, and sensitive information generally requires consent.
APP 5: Notification of Collection of Personal Information	Describes when and under what circumstances APP entities must inform individuals about the collection of their personal information.
APP 6: Use or Disclosure	Defines the conditions under which APP entities may use or disclose personal information they hold.
APP 8: Cross-Border Disclosure	Requires an APP entity, before transferring personal information overseas, to take reasonable steps to ensure the foreign recipient does not breach the APPs. Importantly, the Australian entity remains accountable for the overseas recipient’s conduct unless an exception applies.
APP 10: Quality of Information	Obligates APP entities to ensure personal information collected, used, or disclosed is accurate, up-to-date, complete, and relevant to its purpose.
APP 11: Security of Information	Requires APP entities to protect personal information from misuse, interference, loss, and unauthorized access, and to destroy or de-identify it when necessary.
APP 12: Access to Information	Establishes obligations for APP entities to provide access to personal information upon request unless a specific exception applies.
APP 13: Correction of Information	Mandates APP entities to correct inaccurate or incomplete personal information they hold.

Section 15 of the Privacy Act requires that an APP entity must not engage in any act or practice that breaches an APP. The Office of the Australian Information Commissioner (OAIC) enforces compliance, handles complaints, and can issue determinations and penalties for serious interferences with privacy.

Australian Information Commissioner v. Facebook Inc

Facebook Inc argued it did not carry on business in Australia and did not collect or hold personal information there, and therefore could not be sued under the Privacy Act. The court framed two issues for this case. First, whether Facebook Inc prima facie "carries on business" in Australia within the meaning of s 5B(3) of the Privacy Act, and second, whether it prima facie collected or held the relevant personal information in Australia.

On the first question, the court found Facebook Inc was engaged in the business of providing data processing services to Facebook Ireland under a Data Transfer and Processing Agreement. On appeal, the Full Federal Court held that a foreign company can "carry on business" in Australia without having any physical presence there at all. Justice Perram wrote that "the concept of carrying on business must… take its shape from the business being conducted," and there's no one-size-fits-all test. The installation of cookies on devices located in Australia, and Facebook Inc's management of the Graph API on behalf of Facebook Ireland for Australian app developers are the two activities that influenced this precedent.

On the second question, the court held it could be inferred that Facebook Inc collected personal information in Australia via cookies installed on Australian users' devices, and separately received that data from Facebook Ireland at its own data centres.

Significant Data Fiduciaries: International Experiences

European Union: GDPR

The GDPR employs a risk-based approach. It doesn't have a named "significant controller" category, but it accommodates for such a scaling through Article 35. This article requires a 'Data Protection Impact Assessment' only for processing "likely to result in a high risk," and Article 37 mandates a DPO only for large-scale monitoring or special-category processing.

China: CIIO

China's Critical Information Infrastructure Operator (CIIO) models from the Cybersecurity Law (CSL), the Data Security Law (DSL), and the Personal Information Protection Law (PIPL) of China. It provides for a close structural match to SDF, using an entity-designation system. Through this, the state formally designates certain operators as CIIOs based on criteria such as sector and scale. Such a designation triggers data localization and heightened security-review obligations. The CIIO dentifies entities whose digital systems and data are considered fundamental to national security, economic stability, and the public interest.

The primary sectors explicitly identified as housing potential CIIOs include:

1. Public Communication and Information Services: This encompasses major telecommunication providers, internet service providers, and platforms that are central to public discourse and information dissemination.
2. Energy: Companies involved in the generation, transmission, and distribution of electricity, oil, and natural gas fall squarely within this category, as their disruption could have immediate and widespread consequences.
3. Transport: This includes aviation, rail, and major public transportation networks whose operational integrity relies on complex information systems for logistics, scheduling, and safety.
4. Water Conservancy: Operators of reservoirs, water treatment facilities, and distribution networks are considered critical due to their role in public health and agriculture.
5.  Finance: The banking, securities, and insurance industries are paramount, as their stability is synonymous with the health of the national economy. Digital payment platforms are also a key focus.
6. Public Services: This broad category includes healthcare providers, social security systems, and other essential services administered to the public.
7. E-government Services: The digital infrastructure that supports government operations, from tax collection to official communications, is a core component of CII.

Beyond these enumerated sectors, the regulations contain a crucial “catch-all” provision. It extends the CIIO designation to any other network facilities or information systems whose disruption could seriously harm China’s core interests. This ambiguity means that companies in sectors like advanced manufacturing, logistics, or even popular consumer technology could potentially be designated as CIIOs if their scale and importance are deemed sufficient by regulators.

Research that engages with "Data Fiduciary"

Fiduciary relationships as a means to protect privacy: Examining the use of the fiduciary concept in the draft Personal Data Protection Bill, 2018

This study, focusing on the use of the term ‘fiduciary’ in Indian law, has been authored by Bailey and Goyal (2019), who were focusing on the framework of the PDP 2019. They noted that, while the inspiration for the term may have come from conventional fiduciary relationships that demand obligations of loyalty and care, such those between physicians and patients, the PDP 2019 did not impose similar obligations. As such, the PDP 2019 did not strictly compel organisations to operate in the best interest of the user; instead, it places more emphasis on good faith and reasonableness, akin to the fair dealing requirements found in contract law. According to their paper, the PDP 2019’s usage of the fiduciary concept may be more of a symbolic move to denote a high degree of rights protection rather than significantly altering notice-and-consent-based laws like the GDPR.

Can we trust trust-based data governance models?

This paper by Bart van der Sloot and Esther Keymolen discusses how fiduciary agents and trust-based institutions are increasingly being considered in legal, regulatory, and ethical discussions as an alternative or addition to traditional data control models. Rather than placing responsibility on individuals to manage their own data and protect their interests, the paper explains that an independent person or organisation could act on behalf of individuals, while also taking the broader public interest into account. The paper notes that such trust-based arrangements are expected to increase public confidence in data sharing, thereby supporting data-driven initiatives. However, it also cautions that these models are not without risks, and highlights that certain approaches, particularly data trusts, may have wide-ranging and significant consequences.

Data Controllers as Data Fiduciaries: Theory, Definitions & Burden of Proof

This legal article by Noelle Wilson and Amanda Reid explores the integration of fiduciary theory into modern U.S. consumer privacy laws. The authors analyze how American states are adopting "data controller" and "data processor" definitions from the European GDPR, yet often fail to provide robust protection or enforcement mechanisms. To address these gaps, they propose a hybrid model that treats data controllers as information fiduciaries with specific duties of loyalty and care. A central argument of the paper is that businesses should be presumed to be data controllers by default in legal disputes. This shift in the burden of proof is justified by the fact that corporations possess superior access to evidence regarding their own data practices. Ultimately, the text argues that merging fiduciary principles with existing regulatory frameworks creates a more flexible, future-proof system for safeguarding personal information.

Challenges

While there is well-established precedent to understand who and what constitutes a Data Fiduciary and what their responsibilities and obligations are, some challenges still persist.

Open-Ended Reasonableness of Security Safeguards

Rule 6 of the DPDP Rules, 2025 requires Data Fiduciaries to implement "reasonable security safeguards," listing measures such as encryption, access controls, and log retention (a minimum of one year). However, it does not define a compliance floor calibrated to sector, data volume, or risk. Unlike frameworks that set tiered or sector-specific technical standards, the Rules leave "reasonableness" to be assessed after the fact, such as during a Data Protection Board investigation following a breach. This could create two problems in practice. One, smaller fiduciaries have no clear benchmark to build toward, and two, larger fiduciaries face residual liability risk even after investing in controls, since adequacy is judged retrospectively rather than certified in advance.

Incomplete Cross-Border Transfer Framework as Data fiduciaries remain dependent on future government notifications to determine permissible jurisdictions for data transfers

Section 16 of the Act and Rule 14 permit the Central Government to restrict transfers of personal data to specified countries or entities, but the "allow-list" or "block-list" of jurisdictions has not been notified. Data Fiduciaries are consequently unable to build durable data-transfer architecture, vendor contracts, or cloud-hosting strategies, since the compliance goalposts depend on a future, unpublished notification. This is compounded by ambiguity over whether restrictions apply only to data already transferred offshore, or also govern the routing of data that is collected outside India in the first place. Such a distinction has major implications for global platforms operating in India but hosting data abroad.

Discretionary and Notification-Based SDF Designation

The Rules operationalize obligations for Significant Data Fiduciaries, but they do not eliminate uncertainty regarding when and how an entity will be classified as significant. The designation remains discretionary and notification-based, limiting regulatory predictability. The criteria for classification as a Significant Data Fiduciary (SDF), such as volume and sensitivity of data processed, risk to Data Principal rights, sovereignty and public-order considerations, and other factors under Section 10, are broadly framed in the Act, and the Rules operationalize the consequences of designation, through annual DPIAs and audits, mandatory DPO, algorithmic due diligence, potential data localisation, without publishing objective thresholds for the designation itself. Entities cannot self-assess in advance whether they will be pulled into the SDF compliance tier.

Vagueness and Over-Delegation

The DPDP Rules, 2025 suffer from vagueness and over-delegation, particularly in relation to DPIAs, data localisation, and cross-border transfers, leading to regulatory uncertainty and weak rights protection. All these criterion are delegated to future government committees or sector-specific notifications rather than specified in the Rules themselves. This pattern of building a framework without establishing the foundation it is to be laid on is efficient for legislative drafting but ends up shifting the real regulatory weight to unaccountable, non-transparent rule-making processes downstream, weakening both predictability for fiduciaries and enforceable rights for Data Principals in the interim.

Fragmented and Delayed Implementation Timeline

The Rules commence in three phases with the core definitions and Board constitution coming out in November 2025, consent-manager obligations in November 2026, and the bulk of substantive obligations (security safeguards, breach notification, children's data, cross-border transfers, and SDF duties) only in May 2027. This staggered rollout means the obligations facing fiduciaries today are partly hypothetical. Organisations must build compliance programmes against provisions that are not yet legally operative and may still be clarified or amended before they take effect, making current investment decisions inherently speculative.

Overlap and Conflict with Sectoral Regulators

Regulated sectors such as banking and payments (RBI), securities (SEBI), insurance (IRDAI), and telecom (DoT/TRAI) already operate under sector-specific data retention, localisation, and reporting mandates. The DPDP Rules layer general-purpose obligations (e.g., erasure timelines, breach notification windows, consent-manager integration) on top of these without a clear harmonisation mechanism, leaving fiduciaries in regulated industries to reconcile potentially conflicting requirements.

Way Ahead

As noted above, the term ‘Data Fiduciary’ serves as the Indian equivalent of the term ‘data controller’ found in the data protection laws of several jurisdictions (including those in the European Union). The substance of the definition is the same as that found in the GDPR, and the use of the term ‘fiduciary’ is more of a symbolic move. Going forward, it remains to be seen how the DPBI will interpret and apply the term and the ‘purpose and means’ test that is the crux of the definition, and the extent to which it will rely on the European conception of the term.

With reference to Significant Data Fiduciaries [SDFs], the core concern is that while the DPDP Rules, 2025 strengthen oversight of Significant Data Fiduciaries, they lack substantive clarity and proportional safeguards. Key obligations such as DPIAs, data localisation, and cross-border transfers are framed in vague terms and heavily delegated to future executive action, creating compliance uncertainty. To make the regime effective and rights-centric, the Rules must clearly define the scope of DPIAs, reintroduce data classification (sensitive and critical personal data), mandate record-keeping, and explicitly set out conditions for international data transfers, rather than leaving these to notifications. Without such clarity, the protection of data principals risks becoming procedural rather than real.