A Data Fiduciary is the central accountable party under India’s DPDP Act 2023 — the person or organisation that, alone or with others, determines the purpose and means of processing personal data. The role is broadly analogous to the GDPR’s “data controller”, but the terminology and specific duties are distinct to the Indian framework.
Data Fiduciaries carry the primary compliance burden: obtaining valid consent, providing clear notices, processing only for the stated purpose, maintaining reasonable security safeguards, enabling Data Principal rights, and notifying the Data Protection Board of breaches. The Act also defines a higher-tier category, the Significant Data Fiduciary, which is subject to extra obligations such as appointing a Data Protection Officer, engaging an independent auditor, and performing periodic Data Protection Impact Assessments.
Distinguishing a Data Fiduciary from a Data Processor (who processes on the Fiduciary’s behalf) matters because it determines who is accountable to the regulator and who must be able to produce evidence of compliance.
Comply automates this — see the DPDP framework page.