Data Fiduciaries under the DPDP Act, 2023: Roles, Duties, Penalties and Case Law

Introduction

Every time you sign up for an app to book a cab or order food online, you hand over your name, phone number, address and often your payment details. The Digital Personal Data Protection Act, 2023 (DPDP Act) answers a simple but vital question who is legally responsible for that information? The answer is the Data Fiduciary. This article explains, in plain language, who a Data Fiduciary is, what the law requires of it, what happens when it fails, and how Indian courts have shaped the right to privacy on which the Act rests.

Who is a Data Fiduciary under the DPDP Act?

Under Section 2(i) of the DPDP Act, a Data Fiduciary is any person who, alone or together with others, decides why personal data is processed (the purpose) and how it is processed (the means). The definition is deliberately wide. A start-up, a hospital, a school, a bank, a large corporation or a government ministry can each be a Data Fiduciary.

Three roles work together under the Act:

Role	Section	Who it is	Example
Data Fiduciary	2(i)	Decides the purpose and means of processing	An online shopping app
Data Principal	2(j)	The individual the data relates to (for a child, includes the parent or lawful guardian)	You, the customer
Data Processor	2(k)	Processes data on behalf of the Fiduciary	The cloud or software vendor that stores the app’s data

A simple example, an online shopping app collects your name and phone number to contact you, your address to deliver orders, and your purchase history to suggest products. Because the app decides why and how this data is used, it is the Data Fiduciary. The cloud company that stores the data for the app is its Data Processor.

The Fiduciary stays answerable. Section 8(1) makes the Data Fiduciary responsible for compliance even when a Processor does the actual work. Section 8(2) allows a Processor to be engaged only under a valid contract. A company cannot shift its legal duty by outsourcing.

Why the word “fiduciary”? In law, a fiduciary holds something in trust for another and must act in that person’s interest. The Act uses the word on purpose: a company holds your data as a trustee, not as an owner. As the maxim says, uberrima fides (utmost good faith) is expected of anyone who holds another’s trust.

Territorial reach. Under Section 3, the Act applies to digital personal data processed in India, and also to processing outside India if it is connected with offering goods or services to people in India.

Significant Data Fiduciaries (Section 10)

The Central Government may notify a Data Fiduciary, or a class of Data Fiduciaries, as a Significant Data Fiduciary (SDF). Under Section 10(1), it considers factors such as the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential impact on India’s sovereignty and integrity, the risk to electoral democracy, the security of the State and public order.

Once notified, an SDF must, under Section 10(2) read with Rule 13 of the DPDP Rules, 2025:

• appoint a Data Protection Officer (DPO) based in India, who reports to the board of directors or a similar governing body and is the point of contact for grievances;
• appoint an independent data auditor to evaluate its compliance;
• carry out a Data Protection Impact Assessment (DPIA) and a data audit at least once every twelve months, and furnish significant observations to the Data Protection Board;
• exercise due diligence that its algorithmic software does not put Data Principals’ rights at risk; and
• follow any restriction the government may notify on transferring specified personal data outside India.

Latest update (October 2026). The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, issued by MeitY on 5 October 2026 under Section 43(1), substitutes “audit” with “data audit” in Section 10(2)(c)(ii). It also corrects Section 9(1) to read “child or of a person with disability”, so the two categories stand separately. Commentators agree the Order is clarificatory and creates no new obligations (Obhan Mason).

Core Duties of a Data Fiduciary

A Data Fiduciary is responsible for personal data across its whole life cycle: collection, use, storage, sharing, retention and erasure. The key duties, with the matching provisions of the Act and the DPDP Rules, 2025, are:

1. Lawful processing only (Section 4). Personal data may be processed only for a lawful purpose, either with the Data Principal’s consent or for a “legitimate use” listed in Section 7 (for example, data the person voluntarily provides for a specific purpose, medical emergencies, employment-related purposes, or compliance with a court order).
2. Clear notice (Section 5; Rule 3). Every request for consent must come with a notice, in clear and plain language, that explains what data is collected, why, how the person can withdraw consent or exercise their rights, and how to complain to the Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution.
3. Valid consent (Section 6). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to data necessary for the stated purpose. Withdrawing consent must be as easy as giving it (Section 6(4)). Under Section 6(10), the burden of proving that notice was given and consent obtained lies on the Data Fiduciary.
4. Accuracy (Section 8(3)). Data used to make a decision about the Data Principal, or shared with another Fiduciary, must be complete, accurate and consistent.
5. Reasonable security safeguards (Section 8(5); Rule 6). The Fiduciary must protect data against breach through measures such as encryption, masking or tokenisation, access controls, logging and monitoring, backups, and suitable contract terms with Processors. Rule 6 requires logs to be retained for at least one year.
6. Breach intimation (Section 8(6); Rule 7). On a personal data breach, the Fiduciary must inform each affected Data Principal and the Board without delay, and file a detailed report with the Board within 72 hours of becoming aware of it (or a longer period the Board allows).
7. Erasure and retention limits (Sections 8(7), 8(8); Rule 8). Data must be erased once consent is withdrawn or the purpose is no longer served, unless a law requires retention. Processors must also be made to erase it. For large e-commerce, online gaming and social media platforms, the Third Schedule deems the purpose to end three years after the user last engaged, and users must get 48 hours’ notice before erasure.
8. Contact details and grievance redressal (Sections 8(9), 8(10); Rule 14). The Fiduciary must publish the business contact details of its DPO or a responsible person, and set up an effective grievance mechanism. Grievances must be answered within a period not exceeding 90 days.
9. Children and persons with disability (Section 9; Rules 10 and 11). Verifiable consent of a parent or lawful guardian is required before processing such data. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited, as is any processing likely to harm a child’s well-being.
10. Respecting Data Principals’ rights (Sections 11 to 14). People have the right to access information about their data, to correct and erase it, to grievance redressal, and to nominate another person to act for them on death or incapacity.

How the DPDP Act Works with Other Indian Laws

The DPDP Act does not operate in isolation. Section 38 provides that it applies in addition to, and not in derogation of, other laws; but where a conflict arises, the DPDP Act prevails. Companies must therefore read it alongside the following:

Law	What it covers	Interplay with the DPDP Act
Information Technology Act, 2000, Section 43A and the SPDI Rules, 2011	Compensation for negligent handling of sensitive personal data	Section 44(2) of the DPDP Act omits Section 43A. That clause commences with the substantive provisions, so Section 43A and the SPDI Rules continue to apply until then (S.S. Rana & Co.)
IT Act, 2000, Section 72A	Criminal liability for disclosing personal information in breach of a lawful contract (up to 3 years’ imprisonment, fine up to Rs 5 lakh, or both)	Continues to apply; the DPDP Act itself imposes only civil penalties
CERT-In Directions dated 28 April 2022 (under Section 70B, IT Act)	Reporting of specified cyber incidents to CERT-In within 6 hours; ICT logs kept for 180 days	Runs in parallel: a single incident may require reporting to CERT-In, to the Data Protection Board and to affected individuals
Right to Information Act, 2005, Section 8(1)(j)	Exemption of personal information from disclosure	Substituted by Section 44(3) of the DPDP Act, in force since 13 November 2025; its validity is under challenge before the Supreme Court (see below)
Sectoral rules (RBI, SEBI, IRDAI, health and telecom regulators)	Data storage, localisation, cyber security and confidentiality norms	Continue to bind regulated entities; where a sectoral rule is stricter, both must be met

Where disputes go. Complaints are decided by the Data Protection Board of India, a digital-first body (Sections 18 to 28). Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (Section 29), and from there to the Supreme Court. Section 39 bars civil courts from entertaining matters the Board is empowered to decide, while the writ jurisdiction of High Courts under Article 226 remains available.

What the Supreme Court and High Courts Have Said

The DPDP Act is the legislative answer to a constitutional command. Indian courts recognised informational privacy long before Parliament codified it, and their reasoning still guides how the Act will be read. The guiding principle is ubi jus ibi remedium (where there is a right, there is a remedy).

Supreme Court

Case	Citation	What it held	Relevance for Data Fiduciaries
Justice K.S. Puttaswamy (Retd.) v. Union of India (nine-judge bench)	(2017) 10 SCC 1	Privacy is a fundamental right under Article 21, and includes informational privacy. Any intrusion must satisfy legality, legitimate aim and proportionality. The Court urged the Union to enact a robust data protection law.	The constitutional foundation of the DPDP Act; consent, purpose limitation and data minimisation flow from it
Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar case)	(2019) 1 SCC 1	Upheld Aadhaar largely, but struck down Section 57 of the Aadhaar Act to the extent it let private entities use Aadhaar authentication on the basis of contract. Stressed data minimisation and limited retention.	Private companies cannot collect identity data merely because a contract allows it; a clear legal basis is needed
District Registrar and Collector, Hyderabad v. Canara Bank	(2005) 1 SCC 496	Privacy attaches to the person, not the place; a customer’s bank records held by a bank remain protected.	Data held by a business still belongs, in privacy terms, to the individual
CPIO, Supreme Court of India v. Subhash Chandra Agarwal (Constitution Bench)	(2020) 5 SCC 481	Personal information can be disclosed under the RTI Act only where larger public interest outweighs privacy, applying a balancing test.	The balancing test now at the centre of the challenge to Section 44(3)
Girish Ramchandra Deshpande v. Central Information Commissioner	(2013) 1 SCC 212	Service records, assets and tax returns of an employee are personal information, exempt from disclosure absent larger public interest.	Shows how employee data is to be treated

High Courts

Case	Court and citation	What it held
Karmanya Singh Sareen v. Union of India	Delhi High Court, 2016 SCC OnLine Del 5334	Directed WhatsApp to delete data of users who left the service before its 2016 policy change, and not to share pre-change data with Facebook. The appeal on WhatsApp’s privacy policy is pending before a Constitution Bench of the Supreme Court.
Zulfiqar Ahman Khan v. Quintillion Business Media Pvt. Ltd.	Delhi High Court, 2019 SCC OnLine Del 8494	Recognised the “right to be forgotten” and “right to be left alone” as part of privacy, and restrained republication of the impugned articles.
Jorawer Singh Mundy v. Union of India	Delhi High Court, W.P.(C) 3918/2021, order dated 12 April 2021	Granted interim relief directing removal of a judgment acquitting the petitioner from search results and a legal database.
Sri Vasunathan v. Registrar General, High Court of Karnataka	Karnataka High Court, 2017 SCC OnLine Kar 424	Directed masking of a woman’s name in a judgment, recognising the right to be forgotten in sensitive matters.
Balu Gopalakrishnan v. State of Kerala (Sprinklr case)	Kerala High Court, interim order, April 2020	Allowed a foreign vendor to process COVID-19 patient data only after anonymisation and with informed consent, and barred commercial exploitation. A leading example of courts insisting on Processor safeguards.

Note: the “right to be forgotten” cases arose before the DPDP Act. Section 12 of the Act now gives Data Principals a statutory right to erasure, subject to retention required by law.

Pending constitutional challenges (as of October 2026)

In The Reporters’ Collective Trust v. Union of India, W.P.(C) 211/2026, with connected petitions by Venkatesh Nayak and the NCPRI, the Supreme Court issued notice on 16 February 2026, declined to stay the DPDP framework, and referred the core questions, including the RTI amendment, to a larger bench (Internet Freedom Foundation). The batch was heard again on 7 August 2026; petitioners attack Section 44(3), Sections 17, 33(1) and 36, and Rules 17 and 23(2) as violating Articles 14, 19(1)(a) and 21 (Fox Mandal). A separate challenge to the Act is also pending before the Delhi High Court.

What this means for companies: until the courts rule otherwise, the Act and Rules remain in force and compliance deadlines continue to run.

Penalties: What Happens When Things Go Wrong?

Section 33 read with the Schedule to the Act empowers the Data Protection Board to impose monetary penalties after an inquiry. The maximum amounts are:

Breach	Provision	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach	Section 8(5)	Rs 250 crore
Failure to inform the Board or affected Data Principals of a breach	Section 8(6)	Rs 200 crore
Breach of additional obligations relating to children	Section 9	Rs 200 crore
Breach of additional obligations of a Significant Data Fiduciary	Section 10	Rs 150 crore
Breach of duties by a Data Principal (for example, a false or frivolous complaint)	Section 15	Rs 10,000
Breach of a voluntary undertaking accepted by the Board	Section 32	Up to the amount applicable to the original breach
Breach of any other provision of the Act or Rules	Residuary	Rs 50 crore

These are ceilings, not fixed fines. Under Section 33(2), the Board must weigh the nature, gravity and duration of the breach, the type of data affected, whether it is repeated, any gain made or loss avoided, mitigation steps taken, and whether the penalty is proportionate. The maxim actus non facit reum nisi mens sit rea (an act does not make one guilty unless the mind is also guilty) does not strictly apply here, since these are civil penalties; but the Board’s assessment of conduct and mitigation means good-faith compliance genuinely counts.

Voluntary undertaking (Section 32). At any stage, a Fiduciary may offer the Board an undertaking to take or refrain from specified action. If accepted, it bars further proceedings on the same matter, unless the undertaking is breached.

Mediation (Section 31). Where the Board considers a complaint can be resolved by mediation, it may direct the parties to attempt it.

For the ordinary user, this means a company that mishandles personal data faces real and substantial consequences.

When Do These Obligations Take Effect?

Most Data Fiduciary obligations and the penalty provisions become enforceable on 13 May 2027. MeitY notified the DPDP Rules, 2025 on 13 November 2025 with a staggered, 18-month rollout (S.S. Rana & Co.; Conventus Law):

Phase	Date	What commences
Phase 1	13 November 2025	Definitions; Data Protection Board provisions (Sections 18 to 26); rule-making and related provisions; Section 44(1) and (3), including the RTI amendment; Rules 1, 2 and 17 to 21
Phase 2	13 November 2026	Consent Manager framework: Section 6(9), Section 27(1)(d) and Rule 4
Phase 3	13 May 2027	All remaining provisions: notice, consent, Fiduciary duties, children’s data, SDF obligations, Data Principal rights, penalties; Rules 3, 5 to 16, 22 and 23

Watch this space. In early 2026, MeitY reportedly consulted stakeholders on shortening the compliance window, particularly for large platforms and Significant Data Fiduciaries, possibly to November 2026 (S.S. Rana & Co.). No amended commencement notification had been located as of the date of this article, so 13 May 2027 remains the operative deadline. Companies should verify the position before relying on it.

DPDP Compliance Checklist for Companies

Vigilantibus non dormientibus jura subveniunt (the law helps the vigilant, not those who sleep on their rights). Companies that start now will be ready well before May 2027.

• Map all personal data: what is collected, where it is stored, who can access it and with whom it is shared
• Decide the lawful basis for each activity: consent or a Section 7 legitimate use
• Rewrite privacy notices and consent flows to meet Section 5, Section 6 and Rule 3
• Build an easy consent-withdrawal option and keep records proving notice and consent
• Review all vendor and Processor contracts for security, breach-reporting and erasure clauses
• Put Rule 6 safeguards in place: encryption, masking, access control, logs kept for at least one year, backups
• Prepare a breach response plan covering CERT-In (6 hours), the Board (72-hour report) and affected individuals
• Fix retention schedules and set up erasure with 48 hours’ prior notice where Rule 8 applies
• Publish DPO or contact details and set up a grievance mechanism with a 90-day outer limit
• Set up verifiable parental or guardian consent for children’s and guardian-assisted data, and stop tracking and targeted ads aimed at children
• Assess whether you may be notified as an SDF, and plan for a DPO, independent data auditor and annual DPIA
• Train employees and document everything, since the burden of proof lies on the Fiduciary

Frequently Asked Questions

1. Who is a Data Fiduciary under the DPDP Act, 2023? Any person, company or government body that decides the purpose and means of processing digital personal data, alone or with others (Section 2(i)).

2. What is the difference between a Data Fiduciary and a Data Processor? The Fiduciary decides why and how data is processed; the Processor only processes data on the Fiduciary’s behalf. The Fiduciary remains legally responsible for the Processor’s actions (Section 8(1)).

3. What is a Significant Data Fiduciary? A Fiduciary notified by the Central Government under Section 10 based on the volume and sensitivity of data and the risks involved. It must appoint a DPO and an independent data auditor and conduct an annual DPIA and data audit.

4. What is the maximum penalty under the DPDP Act? Up to Rs 250 crore per instance, for failing to take reasonable security safeguards to prevent a personal data breach.

5. How soon must a data breach be reported? Affected individuals and the Data Protection Board must be told without delay, and a detailed report must reach the Board within 72 hours (Rule 7). Separately, CERT-In must be informed within 6 hours of specified cyber incidents.

6. When does the DPDP Act fully apply to companies? Most obligations and penalties apply from 13 May 2027. The Consent Manager framework begins on 13 November 2026.

7. Has the DPDP Act been stayed by the Supreme Court? No. In February 2026, the Supreme Court issued notice on challenges to the Act and referred key questions to a larger bench, but declined to stay it.

Conclusion

The DPDP Act, 2023 shifts the question from “Who holds your data?” to “Who is responsible for your data?” The answer is the Data Fiduciary, which must now justify what it collects, explain how it uses it, protect it, and erase it when its purpose is served.

With penalties of up to Rs 250 crore, active constitutional litigation, and the May 2027 deadline approaching, prevention is better than cure has never been truer for Indian businesses. Compliance is not a one-time exercise but a continuing duty of trust.

Need help with DPDP compliance or a data protection dispute? The data protection team at AgreyaLegal advises companies on DPDP readiness, privacy policies, vendor contracts, breach response and representation before the Data Protection Board, TDSAT and the courts. Contact us to schedule a consultation.

Disclaimer: This article is for general information only and does not constitute legal advice. The law is stated as of 21 October 2026.

Sources

• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 — MeitY notifications summarised by S.S. Rana & Co.
• Overview of the DPDP Rules, 2025 — Conventus Law
• DPDP (Removal of Difficulties) Order, 2026 — SCC Online
• Supreme Court notice in Reporters’ Collective Trust v. Union of India — Internet Freedom Foundation
• Supreme Court hearing of 7 August 2026 — Fox Mandal
• Proposal to compress the compliance timeline — S.S. Rana & Co.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts