One Name Is On The Hook
The Processor works for the Fiduciary; the Fiduciary stays responsible for it no matter what the contract says
Read the full guide: Section 2(k) — DPDP Act compliance guide
Watch in English
Summary
Your data leaked from a company you have never heard of.
The Processor works for the Fiduciary; the Fiduciary stays responsible for it no matter what the contract says
Full transcript
Your data leaked from a company you have never heard of.
That was a Processor. It works for the Fiduciary.
On its behalf. That is the whole definition.
You never signed anything with the Processor.
Pause. So whose name is on the hook?
The company you gave your data to.
Section 8 makes it responsible for processing on its behalf.
Irrespective of any agreement to the contrary.
Their contract cannot move that responsibility.
One name is on the hook. The one you chose.
s.2(k), s.8(1), s.8(2), r.6(1)(f) — Digital Personal Data Protection Act, 2023 + Rules, 2025
The definition is already in force · ⏳ the duty itself: In force from 13 May 2027