A Data Fiduciary is any person or organisation that, alone or with others, decides the purpose and means of processing personal data. A clinic, school, coaching institute or shop that collects customer or student details and decides how to use them is typically a Data Fiduciary. Its vendors usually act as Data Processors.
- The test is who decides the purpose and means, not who holds the data.
- Vendors that process data for you are usually Data Processors.
- Significant Data Fiduciaries are a notified class with extra duties.
The definition in plain English
Section 2 of the Act defines a Data Fiduciary as anyone who alone or together with others determines the purpose and means of processing personal data. “Purpose” is why you use the data. “Means” is how: which systems, who has access and how long you keep it.
Who counts, with examples
| Organisation | Why it is a Data Fiduciary |
|---|---|
| Clinic | Decides to collect patient details for appointments, records and reminders |
| School or college | Decides what admission, attendance and guardian data to collect and why |
| Coaching institute | Decides how enquiry, student and parent data are used, including for marketing |
| Online shop | Decides what customer data to collect for orders and promotions |
Data Fiduciary vs Data Processor
A Data Processor handles personal data on behalf of a Data Fiduciary. Examples include a cloud host, a bulk-SMS provider or an accounting tool. The fiduciary stays responsible for the data and should have a contract that covers security and what the processor may do.
What is a Significant Data Fiduciary?
The government can notify certain Data Fiduciaries as “significant” based on factors such as the volume and sensitivity of data, risk to individuals and impact on public order or security. They have extra duties, including a Data Protection Officer based in India, an independent audit and periodic impact assessments. Most small organisations are not expected to be in this category, but check for notifications.
A quick self-test
- Do we decide what personal data to collect?
- Do we decide why we use it?
- Do we choose the tools where it is stored and who can access it?
- Do we decide how long to keep it?
If you answered yes to most, treat yourself as a Data Fiduciary and start with the readiness checklist.
Frequently asked questions
Is an individual freelancer a Data Fiduciary?
Possibly, if they process others’ personal data for their business. The Act excludes processing for purely personal or domestic purposes.
Can an organisation be both fiduciary and processor?
Yes. The role depends on the activity. You can be a fiduciary for your own customers’ data and a processor for data you handle on a client’s behalf.
Sources
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.