In our first post in this series, we introduced four of DPDP’s core roles quickly, just enough to get oriented. This post slows down and actually explains them, using one running example so the definitions stick rather than blur together.
Ashok runs a 40-person IT services company in Chennai. His business touches all five roles in some way, which makes it a useful lens for understanding how they fit together.
Data Principal: the person the data belongs to
This one is the simplest. A Data Principal is just the individual whose personal data is being collected, used, or stored. Not a company, not a system, a person.
For Ashok’s business, the individuals whose personal data is handled may be Data Principals. These include his employees, individual customers, and people who submit contact forms on his website. If Ashok provides IT services to a client company, the client’s employees or contacts may also be Data Principals if their personal data is processed. The company itself is not a Data Principal. Whenever the DPDP Act refers to an individual’s rights, notice, or consent, it refers to the rights, notice, or consent of the relevant individual.
Data Fiduciary: the business that decides what happens to the data
A Data Fiduciary is an individual or organisation that decides why personal data is collected and how it is processed. A business may act as a Data Fiduciary for some activities and a Data Processor for others. Its role depends on how it handles personal data, not simply on its size.
Ashok’s company may act as a Data Fiduciary for its own business activities, such as collecting employee details or managing its own customer contacts. However, when it handles a client’s personal data solely on the client’s instructions, it may act as a Data Processor. The role depends on who determines the purpose and means of processing for each activity, not simply on who handles the data.
Think of it like being the owner of a house. The owner decides who gets a key, what the house is used for, and how long guests can stay. That authority to decide is the defining feature, not the size of the house.
Data Processor: the vendor handling data on the Fiduciary’s behalf
A Data Processor handles personal data on a Data Fiduciary’s instructions, but does not decide why that data is collected or what it is ultimately used for.
Ashok’s company uses a cloud storage provider to store client data. If the provider processes personal data on Ashok’s company’s behalf and follows its instructions, the provider may act as a Data Processor. Ashok’s company may, in turn, be a Data Processor for its client if it handles the client’s personal data on the client’s instructions. The roles depend on the actual processing activities and responsibilities involved.
A simple way to understand the roles: Think of a house owner who hires a contractor to maintain the property. The owner decides what needs to be done, while the contractor carries out the work according to the owner’s instructions. Similarly, a Data Fiduciary determines why and how personal data is processed, while a Data Processor handles the data on the Fiduciary’s behalf.
Significant Data Fiduciary: extra scrutiny for larger or riskier businesses
A Significant Data Fiduciary (SDF) is a Data Fiduciary notified as such by the Central Government under Section 10 of the DPDP Act. The government considers factors such as the volume and sensitivity of personal data processed, risks to individuals, and implications for national security and public order. SDFs have additional obligations under the Act and Rules, including appointing a Data Protection Officer based in India and an independent data auditor, and undertaking prescribed assessments and audits.
Ashok’s company cannot determine its SDF status from its employee count or turnover alone. The Central Government determines which Data Fiduciaries are notified as SDFs. If Ashok’s company is notified, it must meet the additional obligations that apply to SDFs, including the prescribed requirements for a Data Protection Officer, independent audits and assessments.
Businesses should not assume they are SDFs or that they are exempt from SDF obligations based on size or data volume alone. SDF status depends on government notification under the Act. We cover the applicable SDF obligations in our dedicated guide.
Consent Manager: the intermediary platform, not a role most businesses play
A Consent Manager is a separate, registered platform that lets individuals manage their consents across many different Data Fiduciaries from one place, rather than a role that ordinary businesses like Ashok’s take on.
Ashok’s company is not a Consent Manager, and almost certainly neither is yours. This role only applies to a narrow group of businesses building cross-platform consent infrastructure. We cover exactly who that is, and what registering involves, in a dedicated post on Consent Managers.
All five roles, side by side
| Role | What they do |
|---|---|
| Data Principal | The individual whose data it is |
| Data Fiduciary | Determines the purpose and means of processing personal data. |
| Data Processor | Handles data on the Fiduciary’s instructions |
| Significant Data Fiduciary | A Data Fiduciary notified as significant by the Central Government under the DPDP Act. |
| Consent Manager | A registered platform managing consent across many businesses |
Frequently Asked Questions
What is a Data Principal under DPDP?
A Data Principal is the individual whose personal data is being collected, used, or stored, such as a customer, employee, or website visitor.
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides why and how personal data is processed. A Data Processor handles that data on the Fiduciary’s instructions but does not make those decisions itself.
How do you know if your business is a Significant Data Fiduciary?
A business becomes a Significant Data Fiduciary when the Central Government notifies it as such under the DPDP Act. The government considers factors including the volume and sensitivity of personal data processed, risks to individuals, and national security and public order. Businesses should not rely on company size or turnover alone to determine their status.
Is a Consent Manager the same as a Data Fiduciary?
No. A Data Fiduciary is any business that decides how to use personal data for its own purposes. A Consent Manager is a separate, registered intermediary that individuals use to manage consent across many different Data Fiduciaries.
Can one business be more than one role at the same time?
Yes. A business is often a Data Fiduciary for its own customer data while also being a Data Processor for another business it provides services to, depending on the relationship in each specific case.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
