Data custodian
Entity responsible for processing and protecting personal data.
How the laws define this
Regulatory frameworks consistently treat a data custodian as an entity, body, or role tasked with holding, managing, and securing datasets in accordance with compliance and protection standards. These instruments agree that custodians bear binding obligations to enforce access controls, maintain data assets, and implement protective measures such as anonymization or administrative oversight. However, they diverge on whether the role is a regulatory governance entity or an IT operational function. The Draft Personal Data Protection Act / Draft Data Protection Act 2023, the Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee), and the National Strategy for Artificial Intelligence (#AIforAll) - NITI Aayog view custodians as designated organizational bodies subject to registration, reporting, public dataset curation, or data-sharing oversight. Conversely, the Order of the Minister No. 385/NQ - On Approval of Requirements for Data Management narrows the role to a technical function focused strictly on system maintenance, encryption, backups, network protections, and secure disposal.
Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| India | National Strategy for Artificial Intelligence (#AIforAll) - NITI Aayog | Adopted | Focuses on public datasets, anonymization, and stewardship for AI applications in priority sectors. |
| Bangladesh | Draft Personal Data Protection Act / Draft Data Protection Act 2023 | Draft | Emphasizes registration with oversight body and compliance obligations for personal data processing. |
| Kazakhstan | Order of the Minister No. 385/NQ - On Approval of Requirements for Data Management | Repealed | Narrowed to technical role focused on security measures like encryption and access controls. |
| India | Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee) | Under Review | Recommends custodians for non-personal data with anonymisation and data-sharing aspects. |
Definitions (4)
A designated controller/processor (referred to in the draft as a 'custodian') required to register with the Data Protection Board when processing citizens' data. Custodians bear obligations including maintaining processing records, appointing responsible officers, implementing technical and organisational measures, and complying with registration and reporting requirements.
An organisation or actor that collects, processes, stores, or manages datasets on behalf of any principal; custodians have obligations to apply anonymisation standards, publish metadata, respond to sharing requests, and comply with NPDA oversight and registration where applicable.
A technical role responsible for the secure storage, technical controls and operational maintenance of systems that hold data assets, including implementation of encryption, backups, access controls, network protections and secure disposal in line with policies.
Data custodians are designated bodies responsible for maintaining curated public datasets, ensuring data quality, performing anonymization or de-identification, and governing controlled access in line with privacy and governance standards; they uphold stewardship and compliance obligations for shared data.
Not to be confused with
Data controller determines purposes and means of processing, while data custodian implements operational and protective measures.
Data processor acts on instructions, whereas data custodian has direct stewardship and compliance duties.
Questions and answers
What obligations do data custodians have?
Obligations vary: maintaining datasets and anonymization in India's AI strategy; registration and safeguards in Bangladesh draft; technical security in Kazakhstan regulation; anonymization for non-personal data.
How does data custodian differ from data controller?
Data custodians focus on operational, protective, and stewardship roles, while controllers decide on processing purposes.
Are there registration requirements for data custodians?
Yes, in Bangladesh's draft act, custodians must register with the oversight body.
Related Terms
Data Custodian / Controller
Entity responsible for registering and managing personal data processing....
Data Fiduciary
Entity that determines purpose and means of processing personal data....
Data processor
Entity that processes personal data on behalf of a controller....
Data controller
Entity that determines purposes and means of processing....
Data Custodians
Entities responsible for managing and provisioning datasets securely....