Section 10 — Additional Obligations of Significant Data Fiduciary

Every Data Fiduciary carries Section 8's obligations. Significant Data Fiduciaries — SDFs — carry those plus a second, governance-heavy layer that Section 10 sets out. The distinguishing feature of this section is who decides: SDF status isn't a threshold an organisation calculates for itself and self-certifies against, the way GDPR's Article 37 DPO trigger or Article 35 DPIA trigger work. It's a designation the Central Government makes by notification, and the obligations only start once that notification actually names you or your class.

A notified status, built on six risk factors — 10(1)

The Central Government may notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary, based on an assessment of relevant factors including: (a) the volume and sensitivity of personal data processed; (b) risk to the rights of Data Principals; (c) potential impact on the sovereignty and integrity of India; (d) risk to electoral democracy; (e) security of the State; and (f) public order. That list runs well beyond "how much data do you hold" — scale is one factor among six, not the test on its own, which is why company size alone is a poor predictor of who ends up notified.

A Data Protection Officer who answers to the board — 10(2)(a)

An SDF must appoint a Data Protection Officer who (i) represents the SDF under the Act, (ii) is based in India, (iii) is an individual responsible to the Board of Directors or an equivalent governing body, and (iv) is the point of contact for the grievance redressal mechanism. This is a materially heavier requirement than Section 8(9)'s ordinary duty, which only asks a regular Data Fiduciary to publish contact information for a DPO "if applicable" or any other person able to field questions. Once SDF status attaches, "if applicable" stops being optional — a real, India-based individual with a direct reporting line into governance is required, not a shared compliance-team inbox.

An auditor who owes the company nothing — 10(2)(b)

An SDF must also appoint an independent data auditor to carry out a data audit evaluating its compliance with the Act. The operative word is independence: a review carried out by an internal audit team, or by the same function that built the processing systems being reviewed, doesn't satisfy this on its own. The point of an external, independent check is that its findings aren't shaped by internal reporting lines.

DPIA, periodic audit, and whatever else gets prescribed — 10(2)(c)

The third bucket of obligations covers (i) a periodic Data Protection Impact Assessment — a process describing Data Principals' rights and the purpose of processing, then assessing and managing the risk that processing poses to those rights — (ii) a periodic audit, and (iii) any other measures the Rules prescribe. Rule 13 fills in the cadence: once every twelve months from the date an entity is notified as an SDF, and the person who actually runs the DPIA and audit must furnish the Board a report of significant observations directly, not filtered through the company's own management first. Rule 13 also adds two obligations the Act's text doesn't spell out on its face — due diligence confirming that any algorithmic or technical system the SDF uses for hosting, processing or sharing personal data doesn't pose a risk to Data Principals' rights, and, for personal data categories the Central Government separately specifies, a restriction on transferring both that data and its traffic data outside India.

Why this matters in practice

The Schedule to the Act treats a breach of Section 10's additional obligations as its own category, carrying a penalty that may extend to ₹150 crore. That sits below the ₹200 crore ceiling for children's-data breaches and the ₹250 crore ceiling for security-safeguards failures, but it's still enough to make the DPO appointment, the independent audit, and the twelve-month DPIA cycle a governance commitment worth building properly rather than treating as a paperwork exercise done once at notification.

Illustration: a payments company is notified by the Central Government as a Significant Data Fiduciary on account of the volume of transaction data it processes. It must appoint an India-based DPO answerable to its board, engage an independent auditor distinct from its internal risk function, and run a DPIA and audit within twelve months of notification — and again every twelve months after that, not as a one-time exercise tied to its original product launch.

How Section 10 connects to the rest of the Act

Section 2(l) defines "Data Protection Officer" only by reference to the appointment this section requires, and Section 2(z) defines "Significant Data Fiduciary" as whatever the Central Government notifies under this section. Section 8 remains the baseline underneath — SDF status adds obligations, it doesn't replace any of Section 8's. Rule 13 supplies the twelve-month cadence, the reporting-to-Board requirement, the algorithmic due-diligence duty, and the data-localisation restriction that the Act's own text leaves to be prescribed, and the Schedule under Section 33(1) sets the ₹150 crore penalty ceiling.