# Data controller and processor

> Under the GDPR, a data controller decides the purposes and means of processing personal data, and a data processor processes it on the controller's behalf. India's DPDP Act draws the same line with the terms Data Fiduciary and Data Processor. When a fund collects founder applications through software, the fund is normally the controller and the software provider the processor, so the data controller and processor roles sit with different organisations.

Source: https://delsivo.com/glossary/data-controller-and-processor · Updated 2026-11-06

## Key takeaways

- Controller (GDPR) or Data Fiduciary (DPDP): decides why and how.
- Processor: acts on the controller's behalf, under a contract.
- A fund collecting founder data is normally the controller.

## Data controller and processor definitions

| Role | EU GDPR (Article 4) | India DPDP Act 2023 (section 2) |
| --- | --- | --- |
| Decides purposes and means | Controller: "alone or jointly with others, determines the purposes and means of the processing" | Data Fiduciary: "alone or in conjunction with other persons determines the purpose and means of processing" |
| Processes on another's behalf | Processor: "processes personal data on behalf of the controller" | Data Processor: "processes personal data on behalf of a Data Fiduciary" |
| The person the data is about | Data subject | Data Principal |

Both laws expect a contract between the two. GDPR Article 28(3) says processing by a processor shall be governed by a contract or other legal act, and DPDP section 8(2) lets a Data Fiduciary engage a Data Processor only under a valid contract.

## Applied to a venture fund

A founder applies through a fund's portal. The fund decides what to ask, why, who reviews it and how long to keep it, so the fund is the controller. A software provider that stores and processes the application only on the fund's instructions is a processor. Delsivo is designed this way: the fund is the controller of founder data, Delsivo the processor, under a [data processing agreement](https://delsivo.com/dpa), with retention set by the fund.

## Common confusions

- A provider that uses the data for its own purposes acts as a controller for that use.
- Hosting, AI and email providers a processor uses are subprocessors, usually listed publicly so controllers can review them.
- Two organisations can be joint controllers when they decide purposes together.

## Frequently asked questions

### Is a VC fund a data controller?

Normally yes, for the founder and applicant data it decides to collect and use. Take legal advice for your fund's exact position.

### What does a processor need from a controller?

Written instructions in a contract covering the subject, duration, nature and purpose of processing, the types of data and the controller's rights.

### Does India's DPDP Act use the word controller?

No. It uses Data Fiduciary for the party that decides purpose and means, and Data Principal for the person the data is about.

## Sources

- [EUR-Lex: Regulation (EU) 2016/679 (GDPR), Articles 4 and 28](https://eur-lex.europa.eu/eli/reg/2016/679/oj) (checked 2026-11-06)
- [MeitY: The Digital Personal Data Protection Act, 2023 (Gazette text)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) (checked 2026-11-06)

## Related pages

- [Data processing agreement](https://delsivo.com/dpa)
- [GDPR](https://delsivo.com/gdpr)
- [DPDP compliance](https://delsivo.com/dpdp-compliance)
- [Subprocessors](https://delsivo.com/subprocessors)