In this guide 7 sections
Under the Digital Personal Data Protection Act 2023, the Data Principal is the person the data is about. The Data Fiduciary decides why and how that data is used. A Data Processor handles it for the fiduciary. Your business is usually the fiduciary. Your software vendors are usually processors.
Data Principal: the person behind the record
A Data Principal is the individual whose personal data you hold. Your customer is one. So is the job applicant, the delivery contact, the employee on the payroll sheet and the visitor who filled in your enquiry form.
Where the individual is a child or a person with a disability, the Act treats the parent or lawful guardian as acting for them. If you run a tuition centre or a clinic, that matters from the first day.
Read the word “principal” as “the person this row in your database is about”.
Data Fiduciary: the one who decides
The Data Fiduciary decides why personal data is collected and how it is used. That is the test, not who owns the server. If you choose to collect phone numbers so that you can send order updates, you are the fiduciary for those numbers.
A sole trader can be one. So can a hospital chain. The duties differ in weight, but the label is the same.
The fiduciary carries the responsibility for notice, consent, accuracy, security and deletion, and it cannot hand that responsibility to a vendor through a contract clause alone.
Data Processor and Consent Manager
A Data Processor handles data on a fiduciary’s behalf and under its instructions. Your hosted CRM, payroll bureau, courier integration and SMS gateway typically sit in this box, and the Act expects a contract between the two parties.
A Consent Manager is a registered entity that lets a Data Principal give, manage, review and withdraw consent through one interface. Most small firms will never run one. You may meet one when a customer uses such a service to deal with you.
- CRM and billing tools: processors
- Payroll bureau: processor
- Cloud host: processor
- Courier and SMS gateway: processors
Significant Data Fiduciary: the heavier label
The government may notify some fiduciaries as Significant, based on factors such as the volume and sensitivity of the data and the risk to individuals. Extra duties follow, such as appointing a data protection officer and carrying out audits and impact assessments.
Most small and mid-size firms will not be notified. Watch the notifications anyway, particularly if you hold health records, children’s data or consumer data at large scale.
Ask your lawyer whether the label could ever apply to you.
Map the terms onto your own business
Take your system list and mark each line. Who is the Data Principal in this system? Are you the fiduciary? Which vendor is the processor? A short table does the job, and it exposes gaps such as a tool with no written contract.
This is a software view, not legal advice. Your lawyer decides how the Act applies to you.
Fill the table this week and attach it to your data map.
DPDP role map worksheet
A one-page role map that lists each system as a row. Columns name the Data Principals in that system and the processor behind the tool. Others record whether your firm is the fiduciary, whether a written contract exists, and a flag for any Significant Data Fiduciary or consent manager link. A notes column holds open questions for the lawyer.
Open a blank worksheet to printQuestions owners ask
Is my business a Data Fiduciary?
If you decide why and how personal data is used, yes. A shop, school, clinic or agency that collects customer or staff details usually is one.
Can a vendor be a Data Fiduciary too?
Yes. A vendor that sets its own purposes for the data, such as selling analytics, may be a fiduciary in its own right rather than only your processor.
What is a Data Principal’s main right?
The Act gives rights such as access to information, correction, erasure, grievance redress and nominating someone to act for them. Check the current text with your lawyer.
Is this the same as GDPR terms?
They are close cousins. A fiduciary resembles a controller, and a principal resembles a data subject. The duties and details differ, so do not assume they match.