What is a data fiduciary under DPDP? Explained simply.
Data fiduciary explained in plain English: who counts as one under India DPDP Act, what duties they have, and what it means for your personal data.
The simple answer
Under the DPDP Act, a data fiduciary is the entity that decides why and how your personal data is processed. In simple terms, it is the company in charge of your data, not just a tool that touches it.
Because it decides the purpose, the data fiduciary carries the main responsibilities: collecting data fairly, using it for stated purposes, keeping it secure and honouring your rights.
What to check
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
Someone is accountable for your data.
State of Privacy focuses on company behaviour because the data fiduciary is the one accountable. Trackers and vendors matter, but the fiduciary decides what happens.
What to do next
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
People also ask
What is a data fiduciary in simple words?
It is the entity that decides why and how your personal data is processed, so it is accountable for handling it properly.
Is a data fiduciary the same as a processor?
No. A processor handles data on instructions; the fiduciary decides the purpose and carries the main duties.
Why does it matter to me?
Because the fiduciary is who you ask about your data and who is responsible for honouring your rights.
How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.
Talk to Meridian Bridge Strategy →Your personal data belongs to you. Under DPDP, every company must tell you what they have and delete it if you ask. One email is all it takes.
Get the template email →We investigated 107 Indian company websites. The public report shows what we found.