Every marketing agency in India needs to answer this in writing, per client, before May 2027. Most have not started, and those that have usually get it wrong in the same direction: they assume they are only a processor.
The distinction
A Data Fiduciary determines the purpose and means of processing. A Data Processor processes on behalf of a Fiduciary, following instructions. The test is control, not custody. Holding the data does not make you a processor, and not holding it does not make you exempt.
Where agencies get it wrong
Take a performance agency running lead generation. The client says get us qualified leads in Bengaluru. The agency picks the platforms, writes the forms, decides which fields to collect, chooses the enrichment vendor, and decides how long raw leads sit in its own systems before handover.
That agency is deciding purpose and means. On those decisions it is a Fiduciary whatever the contract calls it. Labels in an MSA do not override what actually happens.
Three patterns that usually make an agency a Fiduciary: choosing what personal data to collect rather than being told, retaining data in agency systems after the engagement ends, and using client data to improve agency products or benchmarks.
Why this is expensive to get wrong
Fiduciaries carry the direct obligations. Issuing notice, obtaining valid consent, answering data principal requests, reporting breaches to the Board, appointing a grievance officer. Processors carry contractual obligations to the Fiduciary instead.
An agency that believes it is only a processor builds none of the direct machinery. If the Board later concludes it was acting as a Fiduciary, that absence is the finding. There is no partial credit for having a good contract.
What to do this quarter
List your active clients. For each, write down who decided what data gets collected, who chose the tools, where data sits, and how long you keep it after the campaign ends. Then classify each engagement. Expect a meaningful share to come out as Fiduciary or mixed.
Two structural moves cut your exposure. Stop retaining client personal data in agency systems once a campaign closes, and stop making unilateral decisions about which fields to collect. Both are operationally annoying and both move you toward the lower-obligation position.
General information, not legal advice. Rules current as of July 2026.