Compliance & labour law · Updated October 2026
A Data Fiduciary is the person or organisation that decides why and how personal data is processed. Under the DPDP Act, 2023, every employer is the Data Fiduciary for its employees’ and candidates’ data, even when the payroll run or the attendance device sits with an outside vendor.
Section 2(i) of the Act turns on one question: who determines the purpose and means of processing? The company that hires, pays and manages people does. Anyone who handles the data only on that company’s behalf is a Data Processor under section 2(k). In an Indian HR stack, the split usually looks like this:
| Party | Usual role | Why |
|---|---|---|
| Employer | Data Fiduciary | Decides what to collect for hiring, pay, PF, ESI and tax |
| HRMS or payroll SaaS vendor | Data Processor | Stores and computes data on the employer’s instructions |
| Background check agency | Usually processor, check the contract | Verifies what the employer asks it to verify |
| Group insurer for health cover | Often a separate fiduciary | Uses the data for its own underwriting and claims |
The roles follow facts, not labels. A background verification firm that keeps your candidates’ records to build its own database is deciding a purpose of its own, and that pushes it towards being a fiduciary for that use.
The obligations in sections 4 to 10 (notice, lawful ground, accuracy, security safeguards, breach intimation, erasure, a published contact person and a grievance channel) are scheduled to bind from 13 May 2027, under the phased commencement of the DPDP Rules notified on 13 November 2025. They are not in force for routine HR data today. For most employment processing the lawful ground will be “legitimate use” under section 7(i), which covers purposes of employment and protecting the employer from loss or liability, rather than consent.
The point many HR teams miss: section 8(1) keeps the fiduciary responsible even when a processor does the work. If your payroll outsourcing partner leaks salary files, the regulatory exposure lands on you. That is why processing contracts, access controls and an exit clause covering deletion matter now, while there is time to renegotiate.
Yes. The Act has no headcount or turnover floor for being a fiduciary; size matters only for whether the government might notify you as a Significant Data Fiduciary, which is unlikely for a small employer.
No. The vendor answers to you under its contract, but under the Act you remain answerable to the employee and the Board, so review what your HRMS vendor commits to on security, sub-processors and deletion.
Yes. The definition covers a person deciding purpose and means “alone or in conjunction with other persons”, so a group company sharing a common HR platform with its subsidiaries may be a joint fiduciary for some processing.
For the other side of this relationship, read what the Act means by a Data Principal and which rights your employees will hold.