Are we a Data Fiduciary or a Data Processor?

Short answer: Often both, for different data

You are a Data Fiduciary when you decide why and how personal data is used, as you do for your own staff and customers. You are a Data Processor when you handle data only on another organisation's instructions. Many organisations are both, for different data sets.

What the law says

Section 2(i) and 2(k) define the two roles. Section 8(1) puts the duties on the Data Fiduciary, which must use processors only under a valid contract.

Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 17(1)(d): When an organisation in India processes personal data of people outside India under a contract with a party outside India, most of the Act does not apply. The duty of security safeguards and the responsibility for processors still apply.

Steps

List each data set you handle.
For each, ask: who decides the purpose?
Mark yourself as fiduciary or processor, and name the other party.
Check that contracts match the role.
Route requests about processor data to the fiduciary.

Evidence to keep

Role register by data set
Contracts matching the role

Common mistakes

Calling yourself a processor for data you use for your own purposes
No contract when you act as processor
Answering requests that belong to your client

How it plays out by sector

Banking, financial services and insurance: In co-lending or bancassurance, both parties may decide purposes. Write down who is fiduciary for what.
IT, ITeS, BPO and GCC: You are usually a processor for client data and a fiduciary for staff and candidates.
Central government: ministries and departments: The department is usually the fiduciary; integrators are processors.
Public sector undertakings and utilities: Partners act for you when handling your consumers' data.
Healthcare and hospitals: Partner labs and teleradiology providers usually act for you.

From each seat

Legal & compliance: Check that contracts match the real role. Calling a vendor a processor while it uses data for its own purposes will not hold.
Legal department: Decide the role for each data set and make contracts match.
Procurement department: Check whether the vendor will use the data for its own purposes. If yes, it is not just a processor.

What a good answer from management sounds like

“We know, for each data set, whether we decide or act for someone else, and our contracts say so.” Effort and time: Light · 2 to 4 weeks.