The moment you decide why,you are the fiduciary.

Role is not a company attribute. It is a property of each processing activity.

In one line: A Data Fiduciary determines the purpose and means of processing. A Data Processor processes on behalf of a fiduciary. A company can be both, for different activities.

The estate · SaaS & IT servicesHover to inspect

Your contract says processor. Your roadmap may disagree.

The scene

The product team shipped ‘industry benchmarks’: every customer's metrics pooled, anonymised, compared. It was the most-used feature of the year. It was also the moment the company started deciding the purpose of client data.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
We're a processor everywhere. Any activity where you set the purpose makes you a fiduciary for it. Map role per activity, and review it with every release.
Aggregation removes personal data. Aggregation after processing still required processing personal data for your purpose. Get a basis for the aggregation step itself.

A role register

One row per activity: whose data, who decides purpose, who decides means, which role you hold. Product should add a row before shipping.

Monday morning

  1. 01List features that use client data for your own purposes.
  2. 02Assign a role to each.
  3. 03Tell legal before the next release, not after.

Questions, answered plainly

How do I know if my company is a Data Fiduciary or Data Processor?

A Data Fiduciary determines the purpose and means of processing. A Data Processor processes on behalf of a fiduciary. A company can be both, for different activities.

Do Data Processors have direct obligations under DPDPA?

DPDPA places obligations primarily on Data Fiduciaries, who must ensure processors comply through contract. Processors should expect those obligations to flow down in their contracts.

Sector · SaaS & IT servicesYou think you're the processor. Your contract may disagree.Read → SaaS & IT services · Deep diveYour customer trusts you. You trust twenty others.Read → SaaS & IT services · Deep diveThe DPDPA questionnaire is the new security review.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner