Lesson 1.4: The players in the data ecosystem
Know who is who. Every obligation attaches to a role, so spotting your role is the first step in compliance. This DPDPA 2023 course page explains the players in the data ecosystem in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about the players in the data ecosystem
- Name the main roles under the Act
- Tell a Data Fiduciary from a Data Processor
- Understand what a Significant Data Fiduciary is
One data journey, five roles (the players in the data ecosystem)
Priya shares her phone number with an online store. Priya is the Data Principal. The store decides what to do with the number, so it is the Data Fiduciary. The store hires an SMS company to send offers. That SMS company is the Data Processor. If Priya uses a registered app to manage all her consents, that app is a Consent Manager. The Government can designate large or risky fiduciaries as Significant Data Fiduciaries.
Click each role
Which role are you (the players in the data ecosystem)
| Situation | Role |
|---|---|
| Your company decides to collect customer emails for newsletters | Data Fiduciary |
| A payroll vendor runs salaries on your instructions | Data Processor |
| A cloud storage provider hosts your database | Data Processor |
| A bank that sets its own purposes for customer data | Data Fiduciary |
| A person using your app | Data Principal |
Why roles matter
If you are a fiduciary, almost every duty in the Act lands on you. If you are a processor, your clients will push duties down to you by contract: security, breach notice, deletion on request. Many businesses are both, fiduciary for their own customers and processor for their clients.
Activity (5 minutes) (the players in the data ecosystem)
For each system you listed in Lesson 1.3, write whether your organisation is the fiduciary or the processor.
Check your understanding of the players in the data ecosystem
Q1. Who decides why and how personal data is processed?
Q2. A vendor that processes data only on your instructions is a:
Q3. Who can be notified as a Significant Data Fiduciary?
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.