An assessment against the additional obligations that apply once an organisation is notified — or is realistically approaching notification — as a Significant Data Fiduciary. These sit on top of standard DPDPA requirements, and Section 10 carries penalties up to ₹150 Cr specifically for SDF-level non-compliance, so getting ahead of notification matters more than reacting to it.
Everything a standard organisation handles, plus the additional layer that applies once SDF status is realistically in view.
Whether your scale or type of processing puts you at realistic risk of being notified as an SDF.
Whether the organisation has, or needs, a properly positioned DPO to meet the SDF-specific obligation.
What an SDF's periodic audit obligation actually requires, and whether current practices would hold up under it.
Whether DPIAs are being run for the specific processing that triggers this SDF-level requirement.
The added scrutiny that applies to the technology used in high-scale or high-risk processing under SDF status.
Section 10 penalties run up to ₹150 Cr — the goal is being ready before the notification arrives, not scrambling after.
Applicability comes first — there's no point testing obligations that don't yet apply to you.
Establish whether SDF-level obligations are a realistic near-term concern.
Grounded in your actual scale and type of processing, not a generic assumption either way.
Test current practices against each additional SDF-specific requirement.
DPO positioning, independent audit readiness, DPIA coverage, and technical due diligence — checked individually.
Score every gap identified against the additional obligations.
Scored against the ₹150 Cr Section 10 exposure specifically, not blended with general DPDPA penalties.
Walk through findings and sequence the path to readiness.
Sequenced so the organisation is ready before notification, not scrambling to catch up after.
30 minutes to talk through where you actually stand, no obligation.
Book a Consultation