Data Fiduciary

Also called Significant Data Fiduciary and Data Principal

Under India's DPDP Act, any business that decides why and how personal data is processed. The person the data is about is the data principal, and a vendor that processes data on the fiduciary's behalf is a data processor.

Why it matters

If you decide what customer data to collect and what to do with it, you are the fiduciary and the duties fall on you, even when a vendor does the processing. The government can also name some businesses significant data fiduciaries, with extra duties such as appointing a data protection officer and annual audits.

For example

A fintech app is the data fiduciary for its users' information, so it stays responsible for a breach even though the data sat with its cloud and SMS vendors.

Go deeper

Related terms

DPDP Act Consent Manager Data Privacy

Also in Starting Up

See how founders actually handle this on Co-founders, team and legal, part of the Starting Up hub.

eChai Partner Brands The partnership →