DPDPA Data Fiduciary Duties: Standard and Significant

Executive Summary

A data fiduciary under the DPDPA is the entity that determines the purpose and means of processing, the controller role, and carries all statutory duties, including for processing done by its processors.
Core duties: valid notice and consent (or a legitimate use), security safeguards, breach notification to the Board and affected individuals, erasure when purpose ends, accuracy for consequential decisions, and a grievance mechanism.
The government designates Significant Data Fiduciaries (SDFs) based on data volume and sensitivity, risk to rights, electoral democracy, security, and public order.
SDFs must appoint an India-based DPO reporting to the board, engage an independent data auditor, and conduct periodic Data Protection Impact Assessments.
Draft 2025 rules add SDF-specific measures, including algorithmic due-diligence and potential restrictions on transferring specified data outside India.

The DPDPA concentrates responsibility ruthlessly: one role, the data fiduciary, owns every duty, and delegation buys nothing. Your cloud provider mishandles the data, you answer. Your consent vendor botches the notice, you answer. That design, plus a second tier of designated Significant Data Fiduciaries with governance duties bolted on, makes role-mapping the first exercise in any India compliance program.

Role	Data fiduciary (DPDPA ss. 8-10)
Top penalties	INR 250 crore (security); INR 200 crore (breach notice, children); INR 150 crore (SDF duties)
Regulator	Data Protection Board of India
Framework	MeitY

The baseline duty stack (every fiduciary)

Notice and ground. Itemized notice of data and purpose, in English or any scheduled language, before or at consent; processing rests on consent or a section 7 legitimate use, nothing else.
Security safeguards. Reasonable measures to prevent breaches, the highest-penalty duty (INR 250 crore cap). The draft rules enumerate minimums: encryption, access control, logging with retention, and backups.
Breach response. Dual notification (Board + affected individuals), structured by the rules as prompt intimation plus a 72-hour detailed report.
Lifecycle. Erase on purpose-completion or consent withdrawal; ensure accuracy where data feeds decisions affecting the individual or is disclosed onward.
Interfaces. A published grievance officer and mechanism; readable rights machinery for access summaries, correction, and erasure; consent withdrawal as easy as grant.
Processor governance. Valid contracts only; fiduciary liability is non-delegable, so vendor diligence and audit rights are the control surface.

The SDF overlay

Designated fiduciaries add four things: the India-resident DPO answering to the board of directors; an independent data auditor evaluating compliance; periodic DPIAs feeding significant-processing decisions; and, under the draft rules, algorithmic due-diligence obligations (verifying that algorithmic software deployed on personal data does not pose risks to data principals’ rights) plus possible localization directions for government-specified data categories, a hook that could reintroduce data-localization mandates fiduciary by fiduciary.

Treat SDF readiness as contingency planning: if your India footprint involves scale, sensitive categories, or consumer platforms, build the DPO reporting line and DPIA cadence before designation arrives, retrofitting governance under regulatory attention is the expensive path. The children’s-data rules and the GDPR delta map cover the adjacent obligations; a free scan shows what your India-facing properties collect today.

Frequently Asked Questions

How do I know if we are a fiduciary or a processor?

Same test as GDPR controller/processor: whoever decides why and how data is processed is the fiduciary. Unlike GDPR, the DPDPA places obligations almost entirely on the fiduciary; processors have no direct statutory duties, so fiduciaries must govern them by contract and remain answerable for their failures.

What triggers Significant Data Fiduciary designation?

Government notification based on statutory factors: volume and sensitivity of data processed, risk to data principals' rights, potential impact on India's sovereignty, security, electoral democracy, and public order. Expect large platforms, fintechs, healthtech, and telecoms to be early designations once the rules operationalize the process.

What does the SDF DPO requirement involve?

An individual based in India, responsible to the board of directors, serving as the contact for grievance redressal. It is a governance-residency requirement stricter than GDPR's DPO rules, which allow the officer to sit anywhere in the group.

What must every fiduciary do about breaches?

Notify the Board and each affected data principal. The act sets no materiality threshold; the draft 2025 rules structure it as a prompt initial intimation to affected individuals and a detailed report to the Board within 72 hours. Breach-notification failures carry a penalty cap of INR 200 crore.

When must data be erased?

When consent is withdrawn or as soon as the specified purpose is no longer served, whichever is earlier, unless retention is legally required. The draft rules propose fixed retention backstops for large platforms (erasure after prolonged user inactivity), so lifecycle automation, not policy statements, is what compliance will look like.

Regulatory Crosswalk

GDPR controllersDPDPA

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert