Being notified as a Significant Data Fiduciary is not a finding of wrongdoing. It is a formal classification that adds a specific, mandatory layer of obligations.
August 2026 · 6 min read
Under India's Digital Personal Data Protection Act, 2023, any entity that decides why and how personal data is processed qualifies as a Data Fiduciary — that baseline set of obligations applies broadly. A subset of Data Fiduciaries can additionally be formally classified as a Significant Data Fiduciary, or SDF, and that classification brings a distinct, additional layer of obligations with it. Here is what that classification actually involves.
Section 10(1) gives the Central Government the power to notify any Data Fiduciary, or class of Data Fiduciaries, as significant. The law is explicit that this happens through an assessment against factors set out in the Act itself — significance is not a status an organisation acquires automatically by crossing some internal threshold; it arrives through formal notification.
The Act lists a specific set of considerations relevant to that assessment: the volume and sensitivity of the personal data being processed, the risk to Data Principals' rights, the potential impact on India's sovereignty and integrity, risk to electoral democracy, the security of the state, and public order. These are the statutory criteria under Section 10(1), and the Act does not create categories beyond this list.
Once notification happens, a defined set of additional obligations kicks in under Section 10(2) and Rule 13 — and none of them are optional at that point.
Section 10(2)(a) requires an SDF to appoint a Data Protection Officer who represents the organisation under the Act, is based in India, reports to the board of directors or an equivalent governing body, and serves as the point of contact for grievance redressal. This is a statutory requirement, not a best-practice suggestion.
Section 10(2)(b) requires the appointment of an independent data auditor to carry out an audit evaluating the organisation's compliance with the Act. Once notified, this is mandatory, not discretionary.
Section 10(2)(c) requires both a Data Protection Impact Assessment, identifying and managing risks to Data Principals' rights with documented mitigations, and a periodic audit — an independent check of compliance. Rule 13 clarifies that both have to be carried out once every twelve months from the date of notification, and that whoever conducts them has to furnish a report of significant observations to the board.
Rule 13(3) requires an SDF to exercise due diligence in verifying that its technical measures — including any algorithmic software used for hosting, displaying, uploading, modifying, publishing, transmitting, storing, updating or sharing personal data — are not likely to pose a risk to Data Principals' rights. This obligation is stated specifically in the Rules, not left implicit in the general safeguards requirement.
Rule 13(4) requires an SDF to ensure that personal data specified by the Central Government — based on recommendations from a committee it constitutes for the purpose — along with related traffic data, is not transferred outside India. This restriction only applies to the specific categories of data the government actually names; it is not a blanket data-localisation requirement across everything an SDF holds.
The Act does not treat SDF notification as a finding that the entity has violated the law, that it is under investigation, or that it is presumed non-compliant. It simply means the additional obligations under Section 10 and Rule 13 now apply to that organisation — no more, and no less than that.
The Significant Data Fiduciary framework lives in Section 10 of the Digital Personal Data Protection Act, 2023, together with Rule 13 of the Digital Personal Data Protection Rules, 2025. Together, they add one further, well-defined layer of compliance for the entities the government chooses to notify — a layer worth understanding in advance, since the twelve-month clock on the DPIA and audit obligations starts running from the date of notification itself.
If you're not certain whether your organisation meets the SDF thresholds — or you've been notified and need to operationalise the obligations that come with it — that's exactly what our SDF compliance service covers.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation