What is a data fiduciary?
A data fiduciary is the Digital Personal Data Protection Act's term for any person who, alone or with others, determines the purpose and means of processing personal data (section 2(i)) — the organisation that decides why data is collected and how it is used. It is the DPDP counterpart of the GDPR's "controller", and it can be a company, a firm, a trust, an individual acting in a business capacity or a government body. In WhatsApp messaging it is almost always the brand: the retailer, clinic or lender that chooses whom to message, for what purpose and what to keep.
The Act puts its main duties on the fiduciary. It must process personal data only for a lawful purpose, on consent or one of the listed legitimate uses (sections 4 and 7); give a clear notice of the data and purposes, how to withdraw consent and how to complain to the Data Protection Board (section 5, rule 3); obtain consent that is free, specific, informed, unconditional and unambiguous (section 6); keep data accurate where it is used for decisions, protect it with reasonable security safeguards, report breaches, erase data once the purpose is served or consent is withdrawn, publish a contact for data questions and run a grievance channel (section 8). Children's data needs verifiable parental consent, with no tracking or targeted advertising (section 9).
Section 8(1) makes the fiduciary responsible "irrespective of any agreement to the contrary", including for processing its data processors do for it — a fiduciary may use processors only under a valid contract. That is the line between the two roles: a processor acts on instructions, a fiduciary decides. A vendor that starts using customer data for its own purposes becomes a fiduciary for that processing. Some fiduciaries are designated a Significant Data Fiduciary and carry extra duties such as an India-based Data Protection Officer, independent audits and impact assessments.
Key takeaways
- A data fiduciary is whoever decides why and how personal data is processed — the DPDP Act's counterpart to the GDPR's controller.
- On WhatsApp, the brand that messages its customers is the data fiduciary; its BSP, CRM and Meta usually act as data processors for it.
- Its duties include notice, valid consent, security safeguards, breach notification, erasure, a published contact and a grievance channel.
- Responsibility stays with the fiduciary even for processing its vendors do on its behalf, whatever the contract says.
- Most data-fiduciary duties phase in by 2027; failing to protect data can cost up to 250 crore rupees per breach.
Why the difference matters
Why does a data fiduciary matter?
Knowing you are the data fiduciary settles who answers for your WhatsApp programme. The Data Protection Board will not accept "our BSP sent it" for a campaign to people who never consented, or "our CRM vendor was hacked" for a leak of chat history: the Act makes the fiduciary answerable either way. Most fiduciary duties apply from 13 May 2027 under the notified schedule, and the penalties — up to 250 crore rupees for failing to take security safeguards, up to 200 crore for not notifying a breach — are sized to make boards pay attention well before then.
How does a data fiduciary work?
- Step 1
Map the data you decide about
List what your WhatsApp programme collects — numbers, names, chats, media, order and payment details — and the purpose for each. Where you choose the purpose, you are the fiduciary.
- Step 2
Pick the lawful ground per purpose
Rely on consent for marketing. Some processing, such as using data a customer voluntarily gave for the purpose they gave it, may fall under a legitimate use; document which ground covers which message type.
- Step 3
Give notice and capture consent
Show an itemised Privacy Notice when you ask for consent, keep a consent record of each opt-in, and make withdrawal as easy as giving it — a STOP reply or a button.
- Step 4
Bind your processors
Sign a data processing agreement with your BSP, CRM and chatbot vendors that sets instructions, safeguards, breach notice and deletion, because their processing is your responsibility.
- Step 5
Run rights, grievances and breaches
Publish a contact for data questions, answer access, correction and erasure requests, resolve grievances within the time the Rules allow, and keep a breach plan ready.
A data fiduciary: key facts and limits
- Defined in
- DPDP Act section 2(i)
- GDPR equivalent
- Controller
- Responsibility
- Stays with the fiduciary, incl. for its processors (s. 8(1))
- Processors
- Only under a valid contract (s. 8(2))
- Grievance response
- Within 90 days (DPDP Rules 2025)
- Children
- Under 18: verifiable parental consent, no targeted ads
- Max penalty
- Up to 250 crore rupees (security safeguards)
- Most duties apply
- By 2027 (13 May 2027 on the notified schedule)
Common mix-ups
Common mistakes with a data fiduciary
Assuming the BSP is responsible
A BSP sends on your instructions, so it is usually your processor. Consent, notice and breach duties stay with you; put the vendor's obligations in a contract rather than assuming them.
One consent for everything
Consent must be specific to a purpose. Bundling offers into the consent for order updates fails the test and leaves you without a ground for marketing.
Ignoring vendors' own uses
If a processor uses your customers' data for its own product or marketing, it becomes a fiduciary for that use — and your notice probably did not cover it. Prohibit it in the contract.
Waiting for 2027 to start
Consent records, notices and vendor contracts take months to fix across a live WhatsApp programme. Start now so the duties are met on the day they apply.
Example: A Kochi dental chain draws its lines
A Kochi dental chain sends appointment reminders and whitening offers on WhatsApp through a BSP, keeps patient histories in a cloud CRM and uses a chatbot vendor to answer FAQs. The chain is the data fiduciary for all of it: it decides who is messaged and why. It asks for consent to offers separately from reminders, signs processing agreements with the BSP, CRM and chatbot vendor, and adds a "Contact our data officer" link to every notice. When the chatbot vendor proposes training its general model on the clinic's chats, the chain refuses — that would make the vendor a fiduciary for patients' data, a role nobody agreed to.
Rules of thumb
Best practices for a data fiduciary
- Name one owner for each duty — notice, consent, rights, breach — rather than "legal" in general.
- Review every new WhatsApp tool for whether it would decide purposes of its own.
- Keep marketing and service purposes separate in consent, data and reporting.