Data Principal, Data Fiduciary and Data Processor: Key DPDP Definitions
· Sri Tulasi Tech Labs
Most questions about the DPDP Act come down to a few definitions. Knowing which role your organisation plays for each activity tells you which obligations apply.
Personal data and digital personal data
Personal data is any data about an individual who can be identified by or in relation to that data — a name, phone number, email address, employee ID, IP address linked to a person, photographs and more. The Act covers digital personal data: personal data in digital form, including data collected on paper and later digitised.
Data Principal
The individual the personal data relates to — your customers, employees, job applicants, website visitors or vendors’ contact persons. For a child (anyone under 18), the parent or lawful guardian is included; for a person with a disability, their lawful guardian acting on their behalf.
Data Fiduciary
Any person or organisation that, alone or with others, decides the purpose and means of processing personal data. A retailer running a loyalty programme, a school keeping student records and a company running payroll are all Data Fiduciaries for those activities. The Data Fiduciary carries the main responsibility under the Act — including for processing done by its processors.
Data Processor
An organisation that processes personal data on behalf of a Data Fiduciary, such as a cloud host, a CRM provider or an outsourced call centre. A Data Fiduciary may engage a processor only under a valid contract.
Significant Data Fiduciary
A Data Fiduciary, or class of them, that the Central Government notifies because of factors such as the volume and sensitivity of the data it processes and the risk to individuals. Significant Data Fiduciaries have additional duties, such as appointing a Data Protection Officer.
Consent Manager
A person registered with the Data Protection Board who provides an accessible, transparent and interoperable platform for Data Principals to give, manage, review and withdraw their consent.
Processing
A wholly or partly automated operation on digital personal data — collection, recording, organisation, storage, use, sharing, disclosure, erasure and so on. In practice, almost anything you do with personal data is processing.
Personal data breach
Any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability.
A quick example
An online store (Data Fiduciary) collects a customer’s (Data Principal) address to deliver an order and uses a logistics company (Data Processor) to ship it. The store must ensure the logistics company protects the address and uses it only for the delivery.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.