Data fiduciary
Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT
Meaning
A data fiduciary is the person or body that decides why and how personal data is processed. The term comes from the DPDP Act 2023. It must keep data accurate and secure and report data breaches, which are leaks or thefts of data. It must also erase the data once its purpose is over. Some are notified as significant data fiduciaries. These have extra duties: a Data Protection Officer (DPO) based in India, independent audits and impact assessments. The Data Protection Board can fine a fiduciary up to ₹250 crore for security failures.
Example
A bank collects customers' names, phone numbers and account details to run their accounts. The bank is the data fiduciary. If hackers steal this data because of weak security, the bank must report the breach and can be fined.
Don't confuse with
- Data principal: this is the person the data is about. The fiduciary is the one who uses the data.
- Fiduciary relationship (RTI s.8(1)(e)): this is an RTI exemption for information held in a relationship of trust. It is not a DPDP term.
Related concepts
- Justice B.N. Srikrishna Committee
- Digital Personal Data Protection Act 2023
- Data principal
- Consent manager
- Data Protection Board of India
- DPDP Rules 2025