Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsRole
A Data Fiduciary is any person or organisation that decides why and how personal data is processed. It carries the Act's primary responsibilities.
TL;DR
A Data Fiduciary (Section 2(i)) is any person or organisation that decides why and how personal data is processed, and it carries the Act's primary obligations. The role stays with you even when a Data Processor handles the data, because Section 8(1) makes that responsibility non-delegable.
"Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
The Data Fiduciary is the decision-maker. If your organisation determines the purpose and the means, you are a Data Fiduciary, and most obligations fall on you.
This holds whether you decide alone or with others. The role stays with you even when a Data Processor handles the data: Section 8(1) makes that responsibility non-delegable.
A bank that decides to collect KYC details to open accounts is the Data Fiduciary. A vendor it hires to verify them is a Data Processor.
See how this term differs from the ones people most often confuse it with.
Data Fiduciary vs Data Processor →Data Fiduciary vs Significant Data Fiduciary →Is a Data Fiduciary always a company?
No. Any person, including an individual, firm or the State, is a Data Fiduciary if it determines the purpose and means.
Does using a vendor remove my obligations?
No. Under Section 8(1) the fiduciary stays responsible, including for processing done on its behalf.
Consultant-led and partner-backed.