Who is a data fiduciary under the DPDP Act, 2023?

A data fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. That is the accountable party under the Act — responsible for issuing notice, obtaining valid consent or relying on a legitimate use, ensuring accuracy, implementing reasonable security safeguards, notifying breaches, and honouring data principal rights. A data processor processes on behalf of a fiduciary under a contract, but the fiduciary remains answerable.

What should a data processing agreement contain?

At minimum: the subject matter, duration, nature and purpose of processing, the categories of personal data and data principals, an obligation to process only on documented instructions, confidentiality undertakings, defined security measures, controls and flow-down obligations for sub-processors, assistance with data principal requests and breach notification, deletion or return on termination, and audit rights. Liability and indemnity for data incidents should be addressed expressly rather than left to general clauses.

Does Indian law require data to be stored within India?

There is no single blanket localisation rule. The DPDP Act, 2023 contemplates transfer to countries other than those restricted by the Central Government. However, sector-specific directions do impose localisation — most notably the Reserve Bank of India’s requirements for payment system data. The correct answer therefore depends on the sector, the data type and the regulator involved, and should be assessed against your specific data flows.

Legal consultation

Technology, Data & Privacy Law Consultation in India

Technology and data legal consultation covers software, platforms and personal data. In India the framework includes the Information Technology Act, 2000 and rules made under it, the Digital Personal Data Protection Act, 2023 and sector-specific regulatory directions. A consultation typically addresses SaaS and licensing terms, data processing and transfer arrangements, consent and notice design, intermediary obligations, cyber incident response and contractual allocation of technology risk.

Start a consultation All practice areas

Key takeaways

The DPDP Act, 2023 applies extraterritorially where services are offered to data principals in India.
A data fiduciary remains accountable for processing carried out by its processors, so processor contracts matter.
Notice and consent must be clear, itemised and capable of being withdrawn as easily as it was given.
Cyber incident reporting obligations can apply on short timelines under CERT-In directions.

What we can help with

Matters commonly handled in technology, data & privacy law.

DPDP Act readiness and gap assessment
Privacy notices, consent flows and policies
Data processing agreements and sub-processor terms
SaaS, subscription and licensing agreements
Cloud and infrastructure contracts
Intermediary and platform obligations
Cyber incident response and reporting
AI and automated processing governance
Technology risk allocation in commercial contracts
Cross-border data transfer arrangements

When should you consult a lawyer?

Before launching a product that collects personal data
When a customer requires a data processing addendum
After a security incident or suspected data breach
Before deploying AI features that process user data
When negotiating uptime, liability and indemnity terms
When a regulator or CERT-In communication is received

What information should you prepare?

A consultation is far more productive when these are settled in advance.

What personal data you collect and why
Where the data is stored and who can access it
Which third parties process data on your behalf
Your current notice, consent and retention position
Any incident timeline, if one has occurred

What documents should you bring?

Current privacy policy and terms of use
Data flow or data inventory documentation
Vendor and sub-processor agreements
Customer contracts containing data terms
Security policies and incident logs

Governing law

The primary Indian legislation that applies in this area.

Digital Personal Data Protection Act, 2023
Information Technology Act, 2000 and rules thereunder
CERT-In directions on cyber incident reporting
Indian Contract Act, 1872
Sector regulations issued by RBI, SEBI and IRDAI where applicable

How Sutor works

1Describe your matter in plain language
2Upload the documents that relate to it
3Research the applicable Indian law and authorities
4Get legal guidance on the position and your options
5Continue working on the matter in one place

Frequently asked questions

Who is a data fiduciary under the DPDP Act, 2023?: A data fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. That is the accountable party under the Act — responsible for issuing notice, obtaining valid consent or relying on a legitimate use, ensuring accuracy, implementing reasonable security safeguards, notifying breaches, and honouring data principal rights. A data processor processes on behalf of a fiduciary under a contract, but the fiduciary remains answerable.
What should a data processing agreement contain?: At minimum: the subject matter, duration, nature and purpose of processing, the categories of personal data and data principals, an obligation to process only on documented instructions, confidentiality undertakings, defined security measures, controls and flow-down obligations for sub-processors, assistance with data principal requests and breach notification, deletion or return on termination, and audit rights. Liability and indemnity for data incidents should be addressed expressly rather than left to general clauses.
Does Indian law require data to be stored within India?: There is no single blanket localisation rule. The DPDP Act, 2023 contemplates transfer to countries other than those restricted by the Central Government. However, sector-specific directions do impose localisation — most notably the Reserve Bank of India’s requirements for payment system data. The correct answer therefore depends on the sector, the data type and the regulator involved, and should be assessed against your specific data flows.

Sources & editorial information

Jurisdiction: India
Last reviewed: 17 September 2026
Legal status: Current

Primary sources

Digital Personal Data Protection Act, 2023
Information Technology Act, 2000 and rules thereunder
CERT-In directions on cyber incident reporting
Indian Contract Act, 1872
Sector regulations issued by RBI, SEBI and IRDAI where applicable

This page is general legal information about Indian law, prepared against identified legal sources. It is not legal advice and does not create a lawyer–client relationship. Apply it to your own facts only after a consultation with a qualified legal professional.

Need help with a technology, data & privacy law matter?

Describe the matter, upload the relevant documents and work through the position with legal assistance.

Start a consultation Browse legal questions