Under the DPDP Act the data fiduciary carries the main duties: process personal data only for a lawful purpose with valid consent or a recognised legitimate use, give a clear notice, keep the data accurate and secure, report breaches, delete it when the purpose is served or consent is withdrawn, and answer the data principal’s requests. Large-scale processors may be notified as Significant Data Fiduciaries with extra duties.
Software vendors that process data on the brokerage’s instructions — a CRM, an SMS provider, a cloud host — are data processors. The fiduciary remains responsible for them, so it should have a contract that limits what they do with the data. A channel partner who passes a buyer’s details to a builder makes the builder a fiduciary for its own use of that data too.
Example
Who is who in one deal (illustrative)
A buyer enquires with a Pune channel partner, who registers her with a builder. The CP is a data fiduciary for its own CRM records; the builder is a data fiduciary for its booking records; the CRM and SMS providers each process data as processors. If she withdraws consent, each fiduciary must stop its own processing and tell its processors.
Questions about Data fiduciary
Is a small broker a data fiduciary?
Yes. The DPDP Act applies to digital personal data regardless of business size, so a one-person brokerage that keeps leads in a phone, spreadsheet or CRM is a data fiduciary. The extra duties of a Significant Data Fiduciary apply only to entities the government notifies.
What is the difference between a data fiduciary and a data processor?
The fiduciary decides the purpose and means of processing and is accountable under the Act. The processor processes data on the fiduciary’s behalf and instructions, such as a CRM or cloud provider. The fiduciary must use processors only under a valid contract (Section 8(2) of the Act).
Sources
See also
Reviewed