Lesson 2.4: Data Fiduciary, Joint Fiduciaries and Data Processor

Module 2 · Lesson 2.4 of 6 · About 30 minutes · Data Fiduciary Joint Fiduciaries and

The most important role question in compliance: are you in charge of the data, or acting for someone who is? This DPDPA 2023 course page explains data fiduciary joint fiduciaries and in plain language.

data fiduciary joint fiduciaries and - DPDPA 2023 course lesson banner

What you will learn about data fiduciary joint fiduciaries and

Apply the decision test for fiduciary versus processor
Understand joint fiduciaries
Know what to put in a processor contract

The decision test (data fiduciary joint fiduciaries and)

A Data Fiduciary alone or together with others decides the purpose and means of processing. A Data Processor processes on behalf of a fiduciary. Ask: who decides why the data is collected and what happens to it?

Decision tree: click each question

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Processor contract clauses to include (data fiduciary joint fiduciaries and)

Clause	Why
Process only on documented instructions	Keeps purpose limited
Security safeguards at least equal to Rule 6	Meets the legal baseline
Breach notice to you without delay	You must report to the Board and persons
Erase or return data on request or at end	Meets erasure duty
Sub-processor approval	Controls the chain
Audit and cooperation rights	Lets you prove compliance

Worked example

A coaching centre uses an SMS vendor. The centre decides who gets messages (fiduciary), the vendor sends them (processor). If the vendor is breached, the centre must still report to the Board.

Activity (5 minutes) (data fiduciary joint fiduciaries and)

List three vendors and write fiduciary or processor next to each. Check whether a written contract exists.

Key takeaway: Liability stays with the fiduciary. A good contract does not move the liability, but it lets you recover losses.

Check your understanding of data fiduciary joint fiduciaries and

Q1. Who is liable for a processor’s breach of duty under the Act?

Q2. Can there be more than one fiduciary for the same data?

Q3. A payroll vendor following your instructions is a:

← The Data Principal Consent Managers, Significant Data Fiduciaries, the Board and the Tribunal →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for data fiduciary joint fiduciaries and: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.