The One Who Decides
The test is purpose and means, never possession — and “alone or in conjunction with other persons” means two deciders are two Data Fiduciaries.
Read the full guide: Section 2(i) — DPDP Act compliance guide
Watch in English
Summary
Who is responsible for your data? Not who holds it.
The test is purpose and means, never possession — and “alone or in conjunction with other persons” means two deciders are two Data Fiduciaries.
Full transcript
Who is responsible for your data? Not who holds it.
The Act's name for them is Data Fiduciary.
Whoever determines the purpose and the means of processing.
Purpose is why. Means is how.
Pause. Two companies decide together. Which one is it?
Both.
The definition says alone or in conjunction.
So the Fiduciary test is never who has the file.
It is who decided what happens to it.
Find the decider. That is your Fiduciary.
s.2(i) — Digital Personal Data Protection Act, 2023 + Rules, 2025
Already in force (13 Nov 2025)