Data Principal
LawThe individual the personal data is about — a customer, a website visitor, an employee, a patient. Every right covered in Chapter 05 belongs to the Data Principal, and every obligation in this guide ultimately exists to protect their interests. A Data Principal doesn't need to take any action to hold this status — anyone whose personal data is processed is one, whether or not they're aware of it.
Data Fiduciary
LawThe entity that determines the purpose and means of processing — in practice, this is almost always your organisation if you're reading this guide. Section 8 places the weight of the Act's obligations here: implementing security safeguards, notifying breaches, honouring rights requests, and remaining responsible for a Processor's compliance even where processing has been outsourced. Two organisations can each independently be a Fiduciary over the same Data Principal for different purposes — a payroll provider is a Fiduciary for its own processing (say, its own marketing to that individual) while also being a Processor for its client's payroll purpose.
Data Processor
LawAn entity that processes personal data on a Fiduciary's behalf, under contract, rather than for its own purposes. A Processor has no direct obligations to the Data Principal under the Act — Section 8(1) makes the Fiduciary responsible for compliance regardless of what a Processor does or doesn't do, which is exactly why Chapter 12 on vendor management and contracts matters as much as it does. A payment gateway, an email delivery service, and a cloud hosting provider are all typically acting as Processors for the businesses that use them.
Consent Manager
LawA registered, interoperable platform through which a Data Principal can give, review, and withdraw consent across multiple Fiduciaries from a single place (Section 6(7)). Under DPDP Rules Rule 4, a Consent Manager must be an Indian-incorporated company with a minimum net worth of ₹2 crore, registered with the Data Protection Board. This is a distinct, optional infrastructure layer — most businesses will integrate with Consent Managers as one channel among several, not become one themselves, in the same way most businesses accept payments without becoming a payment processor.
Significant Data Fiduciary (SDF)
LawA Data Fiduciary the Central Government specifically notifies as carrying elevated risk, based on factors under Section 10 including the volume and sensitivity of data processed, risk to Data Principals' rights, and potential impact on India's sovereignty, electoral integrity, and public order. SDF status isn't something a business declares about itself — it's assigned by government notification — and it layers extra obligations (an India-based DPO, an independent auditor, DPIAs, cross-border transfer restrictions) on top of ordinary Fiduciary duties, not instead of them. Chapter 13 covers this in full.
Data Protection Board of India
LawThe adjudicatory body established under Section 18 to enforce the Act — investigating breaches and complaints, imposing the penalties set out in the Act's Schedule, directing remedial action, and accepting voluntary undertakings. Its establishment took effect in November 2025 as part of Stage 1 of DPDP's phased commencement; its enforcement powers around registration and penalties come online in later stages, covered in Chapter 18.
How the Roles Relate
| Role | Owes obligations to | Primary source |
|---|---|---|
| Data Fiduciary | Data Principal, Data Protection Board | Sections 4–10 |
| Data Processor | The Fiduciary that engaged it (contractually) | Section 8(2) |
| Consent Manager | Data Principals it serves, Data Protection Board (registration) | Section 6(7), Rule 4 |
| Significant Data Fiduciary | Same as Fiduciary, plus Board (audits, DPIA) | Section 10 |
A SaaS company is a Data Fiduciary for the customer data it collects through its own signup flow, and simultaneously a Data Processor for any customer data its own clients upload into the platform to be processed on their behalf. Its obligations differ depending on which hat applies to a given piece of data — which is exactly why "am I the Fiduciary or the Processor here?" is one of the first questions worth asking about any given dataset.