Under India’s Digital Personal Data Protection Act, 2023, a data fiduciary is any person or organisation that, alone or with others, decides the purpose and means of processing personal data. If your business collects email addresses and decides to send them newsletters, you are the data fiduciary for that list. The term plays the role that “controller” plays under the GDPR.
Data fiduciaries carry the main obligations of the Act. They must give notice and obtain valid consent (or rely on a legitimate use the Act allows), keep personal data accurate where it is used to make decisions, protect it with reasonable security safeguards, report personal data breaches to the Data Protection Board and affected people, erase data when the purpose is served or consent is withdrawn unless the law requires retention, and offer a way to handle grievances.
A data fiduciary remains responsible even when it uses a data processor, such as an email platform, CRM or cloud host. The Act requires a valid contract with the processor, and the fiduciary must ensure the processor stops processing and erases data when needed. Choosing processors with clear security practices and data-handling terms is part of the fiduciary’s job.
The government can also notify some data fiduciaries as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of data they process. These carry extra duties, including appointing a Data Protection Officer based in India, carrying out periodic data protection impact assessments and audits. Most small and mid-sized businesses running email marketing will not be in this group, but the core duties apply to everyone.
A Bhopal coaching centre collects student emails through its website and sends exam tips. It decides what to collect and why, so it is the data fiduciary. Its email platform stores and sends the messages on its instructions, so the platform is a data processor working for the centre.
MailNesto supports a data fiduciary’s duties with consent history, a data-requests log for access, correction and erasure requests with due dates, contact export and erasure, and optional retention rules that remove long-inactive contacts.