Significant Data Fiduciary: Are You on the Government's Radar?

Who this is for: DPOs, founders, boards and compliance heads at organisations that process large volumes of personal data or sensitive categories such as financial, health or children's data.

Most DPDP obligations apply equally to every Data Fiduciary. Section 10 is the exception. It lets the government designate certain fiduciaries as Significant Data Fiduciaries (SDFs) and impose a heavier set of governance obligations on them. For large organisations, designation changes the shape of the compliance programme, and the timeline may be shorter.

For the general obligations every fiduciary faces, see The DPDP Act, Explained.

Who can be designated

Under Section 10(1), the central government may notify any Data Fiduciary, or class of Data Fiduciaries, as significant, based on an assessment of factors including:

• the volume and sensitivity of personal data processed
• the risk to the rights of Data Principals
• the potential impact on the sovereignty and integrity of India
• the risk to electoral democracy
• the security of the State
• public order

No criteria or designations had been published at the time of writing. But the factors point clearly at certain organisations: large banks, NBFCs and insurers; payment and lending platforms; telecom operators; large social media, e-commerce and gaming platforms; hospital chains and health platforms; and services handling large volumes of children's data.

What SDFs must do

Breach of these additional obligations carries a penalty of up to ₹150 crore, on top of any penalties for the obligations that apply to all fiduciaries.

The timeline question

SDF obligations take effect with the rest of the substantive Rules on 13 May 2027, as set out in our DPDP compliance timeline. In early 2026, however, MeitY consulted on shortening the runway for SDFs to 12 months. No amendment had been notified at the time of writing, but likely SDFs should plan as if an earlier date could apply.

How to prepare before designation

You do not need a notification to start. Organisations that are likely SDFs should:

1. Run a designation assessment against the Section 10 factors, and brief the board.
2. Decide on the DPO role: who it will be, where it sits, and how it relates to existing compliance, risk and security roles. The DPO must be based in India and responsible to the board.
3. Select an independent data auditor and agree the audit scope.
4. Run a first DPIA on your highest-risk processing, using your Record of Processing Activities as the base.
5. Inventory algorithmic systems used in processing, such as credit scoring, fraud detection, recommendation and moderation, and document their risk assessments.
6. Check localisation exposure, so you can respond quickly if specific data must stay in India.

Common mistakes

• Waiting for a notification. The work takes longer than any likely notice period.
• Renaming an existing role as DPO. The DPO has specific statutory responsibilities and reporting lines.
• Treating the DPIA as a document. It must assess and manage real risks, every year.
• Ignoring algorithms. Rule 13 makes algorithmic due diligence an explicit obligation.

How ConsentifyAI helps

ConsentifyAI gives likely SDFs the evidence base their DPO, auditor and board need. The ROPA module provides the processing inventory for annual DPIAs, compliance reporting maps each obligation to its controls and evidence, and the tamper-evident audit trail supports the independent audit Rule 13 requires.