Key takeaways
- Controller (GDPR) or Data Fiduciary (DPDP): decides why and how.
- Processor: acts on the controller's behalf, under a contract.
- A fund collecting founder data is normally the controller.
Data controller and processor definitions
| Role | EU GDPR (Article 4) | India DPDP Act 2023 (section 2) |
|---|---|---|
| Decides purposes and means | Controller: "alone or jointly with others, determines the purposes and means of the processing" | Data Fiduciary: "alone or in conjunction with other persons determines the purpose and means of processing" |
| Processes on another's behalf | Processor: "processes personal data on behalf of the controller" | Data Processor: "processes personal data on behalf of a Data Fiduciary" |
| The person the data is about | Data subject | Data Principal |
Both laws expect a contract between the two. GDPR Article 28(3) says processing by a processor shall be governed by a contract or other legal act, and DPDP section 8(2) lets a Data Fiduciary engage a Data Processor only under a valid contract.
Applied to a venture fund
A founder applies through a fund's portal. The fund decides what to ask, why, who reviews it and how long to keep it, so the fund is the controller. A software provider that stores and processes the application only on the fund's instructions is a processor. Delsivo is designed this way: the fund is the controller of founder data, Delsivo the processor, under a data processing agreement, with retention set by the fund.
Common confusions
- A provider that uses the data for its own purposes acts as a controller for that use.
- Hosting, AI and email providers a processor uses are subprocessors, usually listed publicly so controllers can review them.
- Two organisations can be joint controllers when they decide purposes together.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), Articles 4 and 28 (checked 6 November 2026)
- MeitY: The Digital Personal Data Protection Act, 2023 (Gazette text) (checked 6 November 2026)
Facts about other companies and services come from the pages listed, on the dates shown, and can change.