Compare terms

Data Fiduciary vs Data Processor

The difference comes down to control. A Data Fiduciary decides why and how personal data is processed. A Data Processor only acts on the fiduciary's instructions. The fiduciary carries the responsibility either way.

Why the distinction matters

Responsibility follows control. The Data Fiduciary is the party the Data Protection Board and Data Principals deal with, and it carries the statutory duties — including breach notification under Section 8(6). A Data Processor acts on the fiduciary's instructions under a valid contract (Section 8(2)). Misclassifying either role mis-allocates liability, the breach-reporting duty and contract obligations.

When each applies

You are a Data Fiduciary for data whose purpose and means you decide — your own customers and employees. You are a Data Processor when you handle another organisation's data strictly on its instructions, such as a SaaS platform, a payroll bureau or a KYC-verification vendor. The same company is frequently both: a fiduciary for its own users and a processor for its clients' data.

Common confusions to avoid

“Outsourcing shifts the responsibility.” It doesn't. Under Section 8(1) the fiduciary's responsibility is non-delegable, even when a processor does the work.

Assuming the processor answers to the Board. The Rule 7 breach-notification duty sits with the fiduciary; the processor's job is to escalate and assist under contract.

Thinking a processor has no duties. It must be engaged under a valid contract and meet the security safeguards required in that contract under Rule 6.

Related glossary terms

Frequently asked questions