Under the Digital Personal Data Protection Act, 2023, the person who determines the PURPOSE and MEANS of processing personal data is termed the:

Section 2 of the DPDP Act, 2023 defines the 'data fiduciary' as the person who, alone or in conjunction with others, determines the purpose and means of processing personal data. The 'data principal' is the individual to whom the data relates, the 'data processor' processes on behalf of a fiduciary, and a 'consent manager' is a fiduciary enabling consent to be managed. The fiduciary bears the core obligations - lawful purpose, consent or legitimate use, notice, security safeguards, and the fulfilment of the data principal's rights. Getting the role terminology right is foundational DPDP knowledge.