Paragraph match score 79.9%
Page A-023
Data Processors vs Data Fiduciaries: Operational Responsibilities Explained
Under the DPDP Act, the data fiduciary decides why and how personal data is processed and holds primary regulatory accountability; the data processor acts on that instruction but still has meaningful operational and contractual duties.
Page A-082
Clarifying key questions about BFSI data-processor governance
In DPDP terms, your bank, NBFC, insurer, or fintech is typically the data fiduciary because it decides why and how customer data is processed, and it carries the primary compliance obligations and liability. Vendors that process data only on your documented instructions—such as SaaS providers, cloud platforms, KYC utilities, or call centres—are data processors, and must follow your instructions and implement suitable safeguards. Your due diligence should therefore focus on whether each processor can technically and operationally support your obligations as the fiduciary.