Data Fiduciary Duties

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), a Data Fiduciary is any person or entity that alone or together with others determines the purpose and means of processing personal data. The Act places primary responsibility for protecting personal data on the Data Fiduciary, making it accountable for ensuring that personal data is processed in accordance with the law, regardless of whether processing is carried out internally or through a Data Processor.

The duties of a Data Fiduciary extend across the entire personal data lifecycle. These include providing a clear notice before seeking consent where consent is the basis for processing, obtaining valid consent where required, processing personal data only for lawful purposes, implementing reasonable security safeguards to prevent personal data breaches, ensuring the completeness, accuracy, and consistency of personal data where likely to affect Data Principals or decisions relating to them, erasing personal data once the specified purpose has been fulfilled and retention is no longer required by law, establishing an effective grievance redressal mechanism, and notifying the appropriate authorities and affected Data Principals in the event of a notifiable personal data breach.

The DPDP Act also makes it clear that engaging a Data Processor does not transfer accountability. A Data Fiduciary remains responsible for complying with its obligations even when personal data is processed on its behalf by third-party service providers. Additionally, organizations notified as Significant Data Fiduciaries may have additional obligations, including appointing a Data Protection Officer, appointing an independent data auditor, conducting periodic audits, undertaking Data Protection Impact Assessments (DPIAs), and implementing measures prescribed under the Act and applicable Rules. Together, these duties establish the foundation of privacy governance under India's data protection framework.

In practice, gaps emerge when:

• Privacy notices are outdated or do not accurately describe processing activities.
• Consent records cannot be linked to specific processing purposes.
• Personal data is retained beyond the period necessary to fulfil the stated purpose.
• Third-party Data Processors are engaged without ongoing governance or oversight.
• Organizations cannot demonstrate compliance through documented evidence during audits or investigations.

Organizations fulfil these responsibilities by implementing privacy governance frameworks, maintaining accurate data inventories, documenting processing activities, managing consent throughout its lifecycle, monitoring vendor relationships, and automating compliance workflows. Within Privy, capabilities such as automated data discovery, consent lifecycle management, privacy notice management, data mapping, breach management, Data Principal request workflows, and audit-ready reporting help Data Fiduciaries operationalize their obligations under the DPDP Act while improving governance across the organization.