Am I a Data Fiduciary under India's DPDP Act?

You are likely a Data Fiduciary if you decide the purposes and means of processing personal data of people in India. If you only process data on someone else's written instructions, you are a Data Processor instead (DPDP Act, Section 2(i) and Section 2(k)).

What is the difference between a Data Fiduciary and a Data Processor?

A Data Fiduciary decides why and how personal data is used and carries the primary duties under the DPDP Act. A Data Processor only acts on the Fiduciary's written instructions and does not decide purposes on its own.

Can I be both a Data Fiduciary and a Data Processor?

Yes. Most SaaS companies decide the purpose for their own user data (Fiduciary) while processing customer data on instructions (Processor). Both sets of obligations apply, to different data sets.

When does full DPDP enforcement begin?

Full enforcement begins 13 May 2027, 18 months from the DPDP Rules notification on 13 November 2025.

Tools · Self-check

DPDP Applicability & Action Check

8 questions to find out how India's data protection law applies to you — and what to do about it.

Educational only · not legal adviceLast updated: 4 September 2026Written and edited by Sandesh Kokate

Your answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.

Question 1 of 8

Do you collect personal data of people in India?

Names, emails, phone numbers, addresses, payment details, or anything that identifies a person.