DPDP Roles, explained simply

India's Digital Personal Data Protection Act. Who is who.

This guide is available in English and 14 Indian languages, including Hindi, Bengali, Telugu, Tamil, Marathi, Gujarati, Kannada, Malayalam, Odia, Punjabi, Assamese, Urdu, Konkani and Nepali. Choose yours from the Language menu above.

The roles in DPDP

Five roles, plus the Significant Data Fiduciary special case. Pick your language above.

🙋

Data Principal

What does it mean?

You are the person the data is about.

Think of it this way

Imagine a house that belongs to you. Family members, electricians, painters and cleaners may enter the house, but it still belongs to you. Your personal data is similar. The law exists to protect you.

Why does it matter?

You have rights. Everyone else has responsibilities toward you.

Examples

  • Customer
  • Patient
  • Employee
  • Child (through parent or guardian)
💼

Data Fiduciary

What does it mean?

You decide why personal data is collected and how it will be used.

Think of it this way

You made the guest list. You decided who to invite and why. Others may help you run the event, but the decisions were yours. If something goes wrong, people will look to you because you made those decisions.

Why does it matter?

Most responsibilities under DPDP belong to you.

Examples

  • Hospital
  • Online marketplace
  • Employer

🦸 Special case: Significant Data Fiduciary

This is not a separate role. Think of a city bus and a family car. Both are vehicles and both are driven. But carrying many people brings greater responsibility. Some Data Fiduciaries may later be notified by the Government as Significant Data Fiduciaries. Additional duties may apply.

Examples of additional duties

  • Data Protection Officer
  • Annual DPIA
  • Independent audit
  • Algorithmic due diligence
🍲

Data Processor

What does it mean?

You process personal data on behalf of a Data Fiduciary. You follow their instructions.

Think of it this way

Someone else owns the recipe. You are responsible for preparing the meal, but you do not decide the menu.

Why does it matter?

Your responsibilities mainly come from your agreement with the Data Fiduciary.

Examples

  • Cloud provider
  • Payroll provider
  • Call centre
🎛️

Consent Manager

What does it mean?

A Board registered platform that helps people give, manage, review and withdraw consent.

Think of it this way

Imagine a control panel with switches. People can turn permission on or off whenever they want. Changing their mind should be as easy as making the original choice.

Why does it matter?

People should remain in control of their consent.

Examples

  • Consent management platform
  • Board registered entity
  • Independent intermediary
⚖️

Data Protection Board

What does it mean?

The Data Protection Board is the regulator under the DPDP framework.

Think of it this way

Think of a school principal. The principal does not teach every class. But when rules are broken, complaints arise or discipline is needed, the principal steps in.

Why does it matter?

The Board investigates issues and can impose penalties.

Examples

  • Receives breach reports
  • Handles complaints
  • Can impose penalties

🎭 Can one organisation wear two hats?

Yes.

Many organisations are both Data Fiduciaries and Data Processors.

Think of it this way

A restaurant owner may cook meals for customers in the restaurant and also prepare food for another restaurant under instructions. For its own customers, it acts independently. For the other restaurant, it follows instructions.

Example

A SaaS company:

  • Decides how to process employee data → Data Fiduciary
  • Processes client data according to customer instructions → Data Processor

Both roles can exist at the same time.

Get DPDP ready in hours, not weeks

Take the readiness assessment and generate your compliance documents from your answers.

Open Template Builder