Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsRole
A Data Processor processes personal data on behalf of a Data Fiduciary, under that fiduciary's instructions and a valid contract.
TL;DR
A Data Processor (Section 2(k)) processes personal data on behalf of a Data Fiduciary, under that fiduciary's instructions and a valid contract, and does not decide the purpose or means. The fiduciary stays responsible for the processor's compliance, and the duty cannot be contracted away.
"Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.
The Data Processor acts for the fiduciary, not for itself. It handles data to deliver a service, but does not decide the purpose or means.
A fiduciary may engage a processor only under a valid contract (Section 8(2)), and stays responsible for the processor's compliance. The duty cannot be contracted away.
A payroll company that processes employee data strictly as its client instructs is a Data Processor. The employer is the Data Fiduciary.
See how this term differs from the ones people most often confuse it with.
Data Fiduciary vs Data Processor →Is a Data Processor liable under the Act?
The fiduciary carries primary responsibility. A processor acts under contract and instructions, and the fiduciary stays accountable.
Can one company be both?
Yes. It can be a fiduciary for its own purposes and a processor when handling another fiduciary's data.
Consultant-led and partner-backed.