Data Fiduciary meaning: who it is in a clinic The DPDP Act's three roles, Data Fiduciary, Data Principal and Data Processor, mapped to a small OPD.

A Data Fiduciary is the person who decides why and how personal data is processed. Section 2(i) of the Digital Personal Data Protection Act, 2023 defines it as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data". For the patient records of a private clinic, that person is the clinic.

What are the three roles in the DPDP Act?

Data Fiduciary, Data Principal and Data Processor. The Act defines each in section 2:

• Data Fiduciary (s. 2(i)): decides the purpose and means of processing.
• Data Principal (s. 2(j)): "the individual to whom the personal data relates"; for a child it includes the parents or lawful guardian.
• Data Processor (s. 2(k)): "any person who processes personal data on behalf of a Data Fiduciary".

Who is the Data Fiduciary in a small clinic?

The clinic. Take a one-doctor OPD that registers patients at the desk, writes prescriptions in clinic software and keeps scanned reports in a cloud drive. The clinic chose to collect the data and decided what it is for, so it is the Data Fiduciary. Each patient is a Data Principal; a child patient's parent acts as one too. The clinic software vendor, its cloud host and the cloud drive provider each process data on the clinic's behalf, so each is a Data Processor.

What does the Act ask of a Data Fiduciary?

Section 8 sets the general obligations. Among them:

• Stay responsible for compliance, including processing done "on its behalf by a Data Processor", irrespective of any agreement to the contrary (s. 8(1)).
• Use a Data Processor "only under a valid contract" (s. 8(2)).
• Protect personal data with "reasonable security safeguards to prevent personal data breach", including data a processor handles (s. 8(5)).
• Inform the Data Protection Board and each affected person of a personal data breach (s. 8(6)).
• Erase personal data when consent is withdrawn or the purpose is served, unless a law requires it to be kept (s. 8(7)).
• Publish the contact of a person who can answer patients' questions about their data (s. 8(9)), and set up a way to handle grievances (s. 8(10)).

When these duties apply, and what the DPDP Rules, 2025 add, is covered in our guide to the DPDP Act for clinics.

Does the software vendor become the Data Fiduciary for my patients?

Not while it only processes the data for the clinic. A vendor that starts using patient data for its own purposes is deciding purpose and means itself, which is the Data Fiduciary's role. That is why the questions to ask a vendor are what it does with the data beyond running the software, and whether there is a written contract. See who owns your clinic's patient data and the security questions to ask under DPDP.