Significant Data Fiduciary Under DPDP

What Significant Data Fiduciary means

Section 10 empowers the Central Government to notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary. In deciding whom to notify, the government may consider factors such as the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, security of the State, public order, and other factors it may prescribe. Those factors guide designation; they are not a self-scoring checklist that lets an organization declare itself an SDF.

Once designated, additional obligations apply. Section 10 requires a Significant Data Fiduciary to appoint a Data Protection Officer who represents the Fiduciary under the Act, is based in India, and is responsible to the board of directors or similar governing body; to appoint an independent data auditor to carry out data audits; and to undertake periodic Data Protection Impact Assessments and periodic audits as provided. Other measures may be prescribed.

Rule 13 of the DPDP Rules, 2025 elaborates Significant Data Fiduciary obligations once applicable. Themes include due diligence for algorithmic software used to process personal data where that processing may pose a risk to Data Principals’ rights; verifying that technical and organizational measures and other Rule 13 expectations are met; and complying with any processing restrictions the Central Government may specify regarding certain personal data. Read Rule 13 together with the designation notification that applies to the entity or class — the Rules do not invent private numerical thresholds for who is an SDF.

SDF status is layered on top of ordinaryData Fiduciary responsibilitiesunder Section 8. Designation adds governance intensity; it does not replace baseline duties around purpose, security, breach intimation, retention and rights.

What it means in practice

Monitor official notifications. Whether your organization or sector is designated will turn on Central Government notification — not on industry rumour or vendor scoring models. Track MeitY and Gazette publications rather than inventing internal “SDF thresholds” that mimic statute.

Prepare governance that would scale if designation occurs. Even before any notification, large-scale processors benefit from clear board reporting lines for privacy, documented impact assessment methods, independent audit readiness, and an India-based privacy leadership role with authority. Those preparations support Section 8 maturity and reduce scramble if Section 10 later applies.

If designated, operationalize the DPO, auditor and DPIA/audit calendar explicitly. Define how the DPO escalates to the governing body, how independence of the data auditor is ensured, and how DPIA findings feed remediation. Algorithmic systems that affect individuals may need documented due diligence under Rule 13 — map where automated decisioning or profiling touches personal data.

Watch for additional processing restrictions. Rule 13 contemplates that the Central Government may specify measures regarding certain personal data processed by SDFs. Cross-border and other processing designs should leave room to comply with such orders when issued, without assuming a blanket localisation rule that the Rules do not state for all Fiduciaries.

Common mistakes

• Self-declaring as an SDF (or declaring that you are not one) based on invented volume or sensitivity cut-offs.
• Treating SDF obligations as optional best practice while ignoring that they bind only when notified — and bind firmly once notified.
• Appointing a “DPO” in name only without India presence, governing-body accountability or real authority.
• Assuming SDF status replaces ordinary Section 8 Fiduciary duties.