Data fiduciary The organisation that decides why and how personal data is used, and answers for it.
Short answer. A data fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data. The term comes from section 2(i) of India’s Digital Personal Data Protection Act, 2023, and “person” includes an individual, a company, a firm, a Hindu undivided family and the State. A law firm that decides to summarise client files with an AI tool is the data fiduciary for that processing. Under section 8(1) it stays responsible even when a vendor, called a data processor, does the work for it, and section 8(2) allows a processor to be used only under a valid contract. The DPDP Rules, 2025 add minimum security safeguards, such as encryption or masking, access control, and logs kept for one year. This is general information, not legal advice.
01
What the Act says
Section 2(i): a data fiduciary is any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
Section 2(k): a data processor is any person who processes personal data on behalf of a data fiduciary.
Section 8(1): the fiduciary is responsible for complying with the Act for processing done by it or on its behalf by a processor, whatever any agreement says.
Section 8(2): a fiduciary may involve a processor in offering goods or services to data principals only under a valid contract.
Section 3: the Act covers digital personal data, including paper records that are later digitised, and does not cover data an individual processes for personal or domestic purposes.
02
Main duties at a glance
Duty
Where it is
What it means in practice
Notice
Section 5; rule 3
Tell people in clear language what data you collect, for what purpose, and how to withdraw consent and complain.
Accuracy
Section 8(3)
Keep data complete, accurate and consistent when it is used to make a decision about the person.
Security safeguards
Section 8(5); rule 6
At least encryption, masking or tokens, access control, logs with monitoring, backups, and logs kept for one year.
Breach intimation
Section 8(6); rule 7
Inform the Data Protection Board and each affected person.
Erasure
Section 8(7)
Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it.
Contact and grievances
Sections 8(9), 8(10); rules 9 and 14
Publish a contact person and answer grievances within a period of up to 90 days.
03
An office example
A chartered accountant firm collects clients’ PAN details, bank statements and salary slips to file returns. It decides what to collect and why, so it is the data fiduciary. If a partner uploads those statements to a cloud chatbot to draft a summary, the chatbot provider is processing the data for the firm and is likely to be acting as its data processor, so the firm needs a contract that covers the processing and still answers for security and erasure.
Whether a vendor is a processor or a fiduciary in its own right depends on whether it decides any purposes of its own, for example using customer data to train its models. If the same summary is produced on a machine the firm controls, there is no outside processor for that step, but every other duty in the Act still applies to the firm.
04
Penalties and dates
The Schedule to the Act sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach, and up to ₹50 crore for breaches of other provisions. Section 17(3) lets the Government exempt some fiduciaries, including startups, from certain duties by notification.
The DPDP Rules, 2025 (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025. Rule 1(4) brings the rules on notice, security, breach reporting and data principals’ rights (rules 3 and 5 to 16) into force eighteen months after publication.
ANVE runs models on a device in the office and logs every model call with the user, the app and the model, so an office has its own record of who asked what. The office remains the data fiduciary, and its legal duties remain its own. This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
05
Questions people ask
Is a sole practitioner a data fiduciary?
Yes, if she decides why and how clients’ personal data is processed for her practice. The exclusion in section 3(c)(i) covers only personal or domestic purposes, not professional work.
Is an AI vendor a data fiduciary or a data processor?
It depends on the facts. A vendor that processes your data only on your instructions acts as a processor under section 2(k); one that decides purposes of its own, such as training models on your data, may be a fiduciary for that use.
Does the DPDP Act cover paper files?
Only once they are digitised. Section 3(a) applies the Act to personal data collected in digital form, or collected on paper and digitised later.
Who answers if an AI vendor leaks our client data?
Sections 8(1) and 8(5) keep the fiduciary responsible for safeguards, including for processing a processor does on its behalf. Your contract with the vendor decides how costs are shared between you, not who answers under the Act.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
