Defining Data Fiduciaries: A Global Compliance Checklist (GDPR vs. DPDPA)

By: Advocate, Kanak Purohit, Bombay High Court.

Introduction 

In the modern digital economy, data is no longer just "information", it is a liability. For policy makers, tech founders, and legal professionals, the term "Data Fiduciary" represents a shift from ownership to stewardship. Whether you are operating under Europe’s GDPR or India’s DPDPA 2023, the core question remains: Are you protecting user data as a trustee, or just processing it as a commodity?

1. The Conceptual Shift: Fiduciary vs. Controller

While the EU’s General Data Protection Regulation (GDPR) uses the term "Data Controller," India’s Digital Personal Data Protection Act (DPDPA) introduces the term "Data Fiduciary."

• The Nuance: The word 'Fiduciary' implies a relationship of trust. In policy terms, this means that the entity determining the "purpose and means" of processing has a heightened duty of care—similar to a financial trustee.

2. Global Compliance Checklist: The 2026 Standard

To ensure your platform or policy framework meets global standards, verify these four pillars:

A. The Consent Architecture

• GDPR: Requires "freely given, specific, informed, and unambiguous" consent.

• DPDPA: Focuses on the "Notice" being clear and available in multiple languages.

• Checklist Item: Is your consent mechanism granular? Can users opt-in to marketing while opting-out of data sharing?

B. Data Minimization & Purpose Limitation

• The Rule: You should only collect what is strictly necessary.

• The Policy Trap: Avoid "Dark Patterns" that trick users into sharing more data than required for the service.

C. The Rights of Data Principals (Users)

Every global policy now must account for:

1. Right to Access: Users must know what you have.

2. Right to Correction/Erasure: The "Right to be Forgotten" is now a global legal standard.

3. Grievance Redressal: A clear, time-bound mechanism to resolve user complaints.

3. Significant Data Fiduciaries (SDFs)

Under 2026 regulations, not all fiduciaries are equal. Governments now designate Significant Data Fiduciaries based on:

• Volume of personal data processed.

• Risk to electoral democracy or public order.

• Technical sensitivity of the data (Biometrics, Genetic data).

The Portfolio Perspective: For a policy strategist, identifying whether a startup qualifies as an SDF is the first step in risk mitigation. Failing this check can lead to penalties reaching hundreds of crores (INR) or millions of Euros.

Author's Note:

"During my research into the DPDPA’s implementation in Mumbai’s tech hubs, I’ve seen firms struggle most with 'Legacy Data.' It’s easy to be compliant for new users, but a true policy expert knows that the real risk lies in the un-structured data sitting in your servers from 2018. True compliance requires a data audit, not just a privacy policy update."