Mapping DPDP Roles Onto an Agent Architecture

Section 2 is blunt. The Data Fiduciary determines the purpose and means of processing. The processor acts on the fiduciary's behalf. Agent platforms blur means every day: they plan steps, pick tools, and decide which chunk to retrieve. If you do not draw the line, a court or the Board will draw it for you, after an incident, in a vocabulary you will not enjoy.

This article is the drawing. Put it on one page. Attach it to the DPA. Update it when a tool is added.

A reference map

Component	Usual role	When the role flips
The department that approved the use case	Data Fiduciary	Never, if they still set purpose
Platform vendor (for example Prcept AI)	Processor	If they set new purposes or reuse data across customers
SI who only installs and tunes	Processor	If they operate the service and decide workflows
Model host / API	Processor (sub)	If they train on your prompts for their own models
Human reviewer in the department	Part of the fiduciary	If they are a contracted BPO, then processor staff
Another department consuming the output	Separate fiduciary or joint	If they determine a new purpose for the same data
Annotation or eval lab	Processor (sub)	If they keep samples for their own products

When in doubt, write the more responsible role and then argue down with facts. Hoping you are only a processor is not a fact.

Purpose versus means

Purpose is why. Means is how. Choosing to run a scholarship-eligibility agent is purpose. Choosing chunk size, which model, and whether the agent may email a student is means. The fiduciary can delegate means. It cannot delegate accountability.

A vendor who adds a new agent that profiles teachers because the platform thought it would help has started determining purpose. A vendor who changes retrieval so that family records are pulled into a welfare query has changed means in a way that also changes purpose. Both need a new instruction. Neither is a weekly release note.

Instructions that look like instructions

A processor contract for an agent cannot be a two-page NDA. It needs the purpose, the permitted tools, the data classes, the locations, the subprocessors, the training ban, the breach clock, and an audit right. It also needs a change-control rule: new tools and new data classes are new instructions.

How to keep the vendor a processor

• The institution approves every workflow and every tool in writing.
• The runtime enforces purpose tags. The vendor cannot enable a tool in production without that tag.
• No cross-customer training, evaluation or benchmark use of your data.
• No vendor-owned product analytics on the content of prompts.
• A kill switch the institution can pull.

Role maps are dull until they are missing. Then they are the whole case. Write yours while everyone is still polite.

When the SI becomes the operator

Many departments buy a platform and then ask an SI to run it because they have no staff. The SI who only installs is a processor. The SI who decides which workflow to turn on, which data to connect, and which model to try this week is determining means and sometimes purpose. Write that down. Either pull those decisions back into the department, or accept that the SI is closer to a joint operator than a pair of hands.

Staffing is a role-map issue. A fiduciary with no one who can give instructions is a fiduciary in name. Names do not impress the Board.

Breach notice needs the map

When a trace leaks, someone has to notify. If you do not know who the fiduciary is, you will spend the CERT-In clock arguing. Put the notify role on the map with a deputy. Test it once with a tabletop. A role map that has never been used in anger is a diagram. Diagrams do not call CERT-In.

Write the one-page map and test breach notice

This week, write the map: fiduciary, joint fiduciaries, processors, subprocessors, notify role, deputy. Attach it to the DPA. If two departments share the agent, make them both sign. A handshake between secretaries is not a map.

Next week, decide which decisions the SI is no longer allowed to make. Tools, data sources and models come back to a named officer. WhatsApp requests are not instructions. If you have no officer who can do this job, you do not have a fiduciary in fact. Hire or stop.

This month, tabletop a leak. Start the CERT-In clock. See whether the notify role knows they are the notify role. Fix the map until the tabletop is boring. Boring breach drills are the only good ones.

• Purpose is written. Means may be delegated. Accountability is not.
• New tools are new instructions.
• Cross-customer training flips a processor toward a fiduciary problem.
• No signature on the map, no production data.

Objections you will hear — and what to do with them

Platform vendors will insist they are always only processors. They are, until they add a workflow, train across customers, or refuse to take instructions on a tool. The map should say the conditions that flip the role. Conditions make the argument in advance.

Departments will avoid joint-fiduciary language because it sounds like extra liability. Joint purpose is extra liability whether you write it or not. Writing it lets you share notice and breach duties on purpose instead of in a fight.

SIs will say they only implement what officers ask on WhatsApp. WhatsApp is not an instruction system. If that is truly how work is commissioned, you have an instruction problem, not an SI problem. Fix the instruction path.

Counsel will want a long opinion instead of a one-page map. Ask for both. The map is what operators use at 11pm. The opinion is what the Board will read. Operators do not read opinions in an incident.

Someone will ask whether a ministry can be a processor to a state. It can, if the state determines purpose and the ministry only hosts. It usually does not. Do not copy a hosting MoU and assume the roles follow. Write the roles.

How this shows up in the file

The map is a one-page operating document. If it needs a covering note to be understood, it is too long. Fiduciary, joints, processors, subprocessors, notify, deputy. Signatures. Date. Attach to the DPA. Update when a tool is added.

WhatsApp is not an instruction system. If that is how work is commissioned, you have a role-map problem even if the DPA is perfect. Pull decisions back to a named officer or accept that the SI is determining means in fact.

Tabletop the leak. Start a clock. See whether anyone knows they must call CERT-In. A map that has never been used is a diagram. Diagrams do not notify.

What the next noting must contain

“Mapping DPDP Roles Onto an Agent Architecture” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “DPDP data fiduciary AI”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

If the vendor can change why the agent runs, they are no longer only a processor. Most contracts have not noticed. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “DPDP data fiduciary AI”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.