The DPDPA's Accountability Model: Processor Autonomy, Essential And Non-Essential Means, And Data Fiduciary Liability Under The DPDPA

Prepared by Shubhank Suman, AI, Privacy and IP Counsel

The DPDPA adopts a distinctive accountability model under which the Data Fiduciary remains responsible for compliance even when personal data is processed by a third-party Data Processor on its behalf. Unlike the GDPR and earlier Indian data protection bills, the Act imposes no comparable direct statutory obligations on Processors. Instead, the Data Fiduciary must ensure compliance across the processing chain, including processing undertaken by vendors, service providers, cloud hosts, and other downstream processors. This creates a significant governance challenge. The Data Fiduciary bears legal responsibility for processing that it often does not perform, directly control, or fully observe. The challenge becomes particularly acute in areas such as security, breach management, sub-processor oversight, consent withdrawal, and data erasure, where compliance depends heavily on actions taken within the Processor's environment. This note examines the consequences of this accountability model, including the absence of direct processor liability, the distinction between essential and non-essential means of processing, the operational difficulties of meeting erasure obligations, and the practical controls that Data Fiduciaries should adopt to manage processor-related risk. The central theme is simple: while processing can be delegated, compliance responsibility cannot.

1. The Core Imbalance: The Contract Is The Data Fiduciary's Only Real Control

Under the DPDPA, the Data Fiduciary remains responsible for personal data even when a third-party Processor handles it on the Fiduciary's behalf.

Under Section 8(1), a Data Fiduciary is responsible for complying with the Act in respect of any processing carried out by itself or on its behalf. Section 8(2) permits a Data Fiduciary to engage a Data Processor, but only under a valid contract. Section 8(5) requires the Data Fiduciary to implement reasonable security safeguards, even when the personal data is being processed by a third-party Processor. In addition, Section 6(6) requires the Data Fiduciary to ensure that a Processor stops processing personal data when the Data Principal withdraws consent, and Section 8(7) requires the Data Fiduciary to ensure that the Processor erases the personal data once consent is withdrawn or the specified purpose has been achieved.

The practical challenge is that the DPDPA does not impose equivalent operational obligations directly on the Processor. The Board can look to the Data Fiduciary for compliance failures even where the failure occurred within the Processor's systems. In other words, the Data Fiduciary carries the legal burden, while the Processor often has physical possession of the data and operational control over the systems that process it. This creates a significant compliance gap. The Data Fiduciary cannot directly manage the Processor's servers, databases, backups, access controls, incident-response processes, or subcontracting arrangements. It may have little visibility into how the Processor actually handles personal data on a daily basis. Yet if something goes wrong, a security breach, a failure to erase data, unauthorized sharing with a sub-processor, or continued processing after consent has been withdrawn, the Data Fiduciary remains accountable under the Act.

As a result, the contract becomes the Data Fiduciary's primary compliance tool. Every obligation that the Act places on the Fiduciary must be translated into enforceable obligations for the Processor through contractual controls, audit rights, reporting requirements, and ongoing oversight. Any weakness in that framework ultimately becomes the Fiduciary's risk.

2. The DPDPA's distinctive choice: no direct duties on the Processor The DPDPA represents a deliberate departure from both the GDPR and earlier Indian data protection bills. Across the draft Indian privacy bills issued between 2018 and 2022, Data Processors were subject to direct statutory obligations and could face regulatory consequences for non-compliance. The GDPR follows a similar approach by imposing direct duties on Processors relating to security, record-keeping, breach assistance, and sub-processor management. The DPDPA reverses this model. It imposes no comparable direct statutory obligations on Processors and instead places the compliance burden on the Data Fiduciary. The Fiduciary must therefore secure processor compliance through contractual arrangements, audits, technical controls, and periodic review.

3. The Test: Essential Versus Non-Essential Means

The DPDPA provides that a Data Fiduciary determines the purpose and means of processing, while a Data Processor processes personal data on the Fiduciary's behalf. However, the Act does not explain where instruction-following ends and independent decision-making begins.

The most useful framework for understanding this boundary comes from international privacy practice, particularly the distinction between essential means and non-essential means of processing.

Essential means concern the core "why" and fundamental "how" of processing. A party that independently determines these matters is exercising control over the processing itself and may be regarded as a Data Fiduciary regardless of the contractual label used. For example, a credit-scoring agency that determines which customer attributes will be analysed and how those attributes will be weighted to produce a score is deciding essential means and is therefore acting as a Fiduciary for that activity.

Non-essential means, by contrast, relate to the practical implementation of processing instructions. A cloud hosting provider that determines server capacity, storage architecture, or network configuration while processing data strictly in accordance with customer instructions would ordinarily remain a Data Processor. However, the significance of this distinction under the DPDPA differs from its significance under the GDPR. Under the GDPR, a Processor may exercise a degree of discretion over non-essential means while remaining directly subject to statutory duties and regulatory oversight. The DPDPA adopts a fundamentally different accountability model. Although a Processor may, in practice, make operational decisions concerning non-essential means, the Act imposes no corresponding statutory obligations on the Processor. Instead, the Data Fiduciary remains responsible for processing carried out on its behalf and for ensuring compliance with the Act's requirements relating to security, cessation of processing, retention, and erasure.

Consequently, any discretion exercised by a Processor is effectively exercised at the Fiduciary's risk. A failure in backup architecture that prevents erasure, an insecure system configuration that contributes to a data breach, or a storage design that results in excessive retention may all arise from decisions concerning non-essential means, yet the resulting liability remains with the Data Fiduciary. The distinction between essential and non-essential means therefore remains useful for role classification, but it does not produce the same allocation of responsibility that exists under the GDPR. The practical implication is that a Data Fiduciary must exercise oversight not only over the purpose of processing and other essential means, but also over the Processor's decisions concerning non-essential means. Infrastructure design, hosting arrangements, backup management, security tooling, data-storage configurations, and similar operational choices should be governed through detailed contractual controls, audit rights, technical standards, and ongoing assurance mechanisms. In effect, the DPDPA treats the Processor less as an independently accountable participant and more as an operational extension of the Data Fiduciary. The Fiduciary may delegate the activity, but it cannot delegate the responsibility.