Data fiduciary vs processor: the contract labels will be tested when a breach hits.
A SaaS vendor is breached. The company says “processor only.” The vendor says “you decided the purpose.” Under DPDP, who determined purpose and means — and what the agreement actually allocated — matters more than the slide-deck title. Blame-shifting after notice is not a role. The file will ask who was fiduciary, who processed, and who owed what.
Label in the MSA.
Tested in the breach.
Educational note. This Insight is for awareness relating to cyber law and digital procedure. It is not legal advice and does not create an advocate–client relationship. Series: Digital disputes, as Indian courts actually see them.