NEED FOR A 'JOINT DATA FIDUCIARY' FRAMEWORK IN INDIA: LESSONS FROM THE GDPR'S JOINT CONTROLLERS CONCEPT

India's Digital Personal Data Protection Act, 2023 (DPDPA) establishes a framework centred on the distinction between Data Fiduciaries and Data Processors. While this model is suitable for conventional data-processing relationships, it does not adequately reflect the realities of today's interconnected digital economy, where multiple entities frequently participate in determining how and why personal data is processed. Digital lending arrangements, healthcare platforms, online marketplaces, advertising technology, and other collaborative digital ecosystems increasingly involve shared decision-making, creating uncertainty over accountability when privacy obligations are breached. This paper argues that the absence of an explicit framework governing entities that jointly determine the purposes and means of processing personal data constitutes a significant structural gap in India's data protection regime. Drawing on comparative developments in European data protection law, the paper demonstrates that accountability can be allocated according to the actual influence exercised by participating entities over specific processing activities, rather than relying solely on formal contractual designations. It further contends that a functional approach to shared responsibility would better protect data principals while providing greater legal certainty to businesses operating in collaborative digital environments. The paper proposes the introduction of a "Joint Data Fiduciary" framework through subordinate legislation or regulatory guidance under the DPDPA. It recommends recognising shared decision-making based on substance rather than form, requiring transparent allocation of compliance responsibilities among participating entities, limiting liability to the processing activities over which an entity exercises genuine control, and ensuring that data principals may effectively enforce their statutory rights without navigating complex contractual arrangements. Such a framework would strengthen accountability, align the DPDPA with India's constitutional commitment to informational privacy, and provide a more practical regulatory foundation for the country's rapidly evolving digital ecosystem.