Yes — an organisation can simultaneously hold both roles for different data flows. For example, a cloud SaaS company processes its customers' data as a Data Processor (acting on behalf of its enterprise customers), but processes its own employees' HR data and its own customers' account data as a Data Fiduciary (deciding the purpose and means). In practice, many organisations need to identify each data flow separately and determine the correct role for each — their ROPA should clearly distinguish between data processed as a Fiduciary and data processed as a Processor.

The Data Fiduciary remains primarily liable to the DPB and to affected data principals — even if the breach occurred due to the processor's failure. The DPDP Act's notification obligations and penalty provisions run against the Fiduciary, not the Processor. However, if the breach resulted from the processor's failure to implement agreed security measures, the Fiduciary can seek recovery from the Processor under the contractual DPA. This is why DPAs must include clear security obligations, incident notification timelines (typically 24 hours from processor to fiduciary), liability, and indemnification provisions.

The DPDP Act does not prescribe a specific security standard — the obligation is to implement "reasonable security safeguards" proportionate to the nature and volume of personal data processed. ISO 27001:2022 certification is strong evidence of reasonable safeguards, and KavachOne strongly recommends it as a baseline for Data Fiduciaries processing significant volumes of personal data. However, ISO 27001 alone may not be sufficient for Significant Data Fiduciaries or those processing particularly sensitive data — additional sector-specific standards, enhanced technical controls, and annual DPIAs would typically be expected.

Yes — employers are Data Fiduciaries in relation to their employees' personal data. DPDP obligations apply to employee data collected during recruitment, employment, and post-employment. However, the DPDP Act recognises that many aspects of employment data processing — payroll, tax compliance, statutory reporting — fall under Legitimate Use grounds rather than requiring separate employee consent. Employers must map their employee data processing activities to Legitimate Use or consent basis, update employment contracts and privacy notices accordingly, and establish a mechanism for employees to exercise DPDP rights over their personal data.

The DPDP Act received Presidential assent in August 2023, but its provisions — including the penalty framework — come into force through notification by the Central Government. As of 2025, the Data Protection Board is being constituted and the Rules under the Act are in the final stages of development. Most legal experts expect the Act's enforcement provisions to become operational in 2025–2026. Organisations should treat the present period as the compliance implementation window — those that are fully compliant before enforcement begins will have significant protection from the first wave of DPB scrutiny.