A company that serves users in India decides why and how their digital personal data is processed, and it uses a cloud provider that processes that data only on the company's behalf. Under India's Digital Personal Data Protection Act, how are these parties described?
Select an answer to reveal the explanation.
Short Explanation
India's DPDP Act uses its own vocabulary, so don't drag GDPR words in. The one deciding why and how is the data fiduciary, the person the data is about is the data principal and the one doing the work on instructions is the data processor. If you spot controller or data subject, you're in the wrong statute.
Full Explanation
India's Digital Personal Data Protection Act, 2023 defines a data fiduciary as a person who alone or with others determines the purpose and means of processing personal data, a data principal as the individual to whom the personal data relates and a data processor as a person who processes personal data on behalf of a data fiduciary. The company that decides why and how user data is processed is therefore the data fiduciary, its users are data principals and the cloud provider acting on instructions is a data processor. The fiduciary remains responsible for compliance, including for processing carried out by its processor, and must engage processors under a valid contract. Labeling the company a controller and the users data subjects borrows GDPR terminology, and calling the provider a fiduciary contradicts its role, since it does not decide purpose or means. Making the provider the fiduciary because it stores the data confuses physical custody with decision-making authority. Calling users fiduciaries inverts the relationship; the term fiduciary describes the party trusted with the data, not the individual who provides it. Exam caveat: the act also allows certain fiduciaries to be notified as significant data fiduciaries with added duties. Operational check: confirm the processing contract and records identify the fiduciary, the processor and the purposes of processing.