Rights and duties
Am I a Data Fiduciary or a Data Processor?
- Short answer
- You are a Data Fiduciary if you decide why and how personal data is processed. You are a Data Processor if you process it only on someone else's instructions. Many organisations are both, in different activities, and the role is judged per activity.
The test is decision making, not possession. A payroll bureau holds a great deal of employee data and is usually a Processor, because the employer decides the purpose. The employer holds less and is the Fiduciary.
Being both is normal rather than exceptional. An agency is a Processor for client campaigns and a Fiduciary for its own staff and its own marketing at the same time.
The moment a Processor starts using client data for its own purposes, such as training a model or building benchmarks, it becomes a Fiduciary for that use and needs its own basis for it.
Where this comes from
- Section 2(i) and Section 2(k), DPDP Act 2023
The mistake people make
Deciding the role once for the whole organisation. It is decided activity by activity.