Role
A Data Fiduciary is any person or organisation that decides why and how personal data is processed. It carries the Act's primary responsibilities.
"Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
The Data Fiduciary is the decision-maker. If your organisation determines the purpose and the means, you are a Data Fiduciary, and most obligations fall on you.
This holds whether you decide alone or with others. The role stays with you even when a Data Processor handles the data: Section 8(1) makes that responsibility non-delegable.
A bank that decides to collect KYC details to open accounts is the Data Fiduciary. A vendor it hires to verify them is a Data Processor.
See how this term differs from the ones people most often confuse it with.
Data Fiduciary vs Data Processor →Data Fiduciary vs Significant Data Fiduciary →Is a Data Fiduciary always a company?
No. Any person, including an individual, firm or the State, is a Data Fiduciary if it determines the purpose and means.
Does using a vendor remove my obligations?
No. Under Section 8(1) the fiduciary stays responsible, including for processing done on its behalf.