The Act defines a data fiduciary as any person who alone or in conjunction with others determines the purpose and means of processing personal data. Everything else in the statute — notice, consent, breach reporting, the Board's jurisdiction — hangs off that one sentence.
Determining purpose and means
The test is functional rather than contractual. A vendor described in the agreement as a processor becomes a fiduciary the moment it decides, in substance, why and how data is used — a distinction that matters most for analytics and enrichment services.
Significant data fiduciaries
The Central Government may notify a fiduciary as significant based on the volume and sensitivity of processing and the risk to electoral democracy and public order. The additional duties include appointing a Data Protection Officer resident in India and commissioning independent audits.
Being called a processor in a contract is not a defence; the Act asks who actually decided.
What to do now
- Map every processing activity to a named decision-maker.
- Review vendor contracts against the functional test, not the labels.
- Prepare a consent notice in every language listed in the Eighth Schedule.
- Fix an internal breach escalation clock shorter than the notified deadline.
Sources & citations