What is a Significant Data Fiduciary?
A Significant Data Fiduciary (SDF) is a Data Fiduciary that the central government has notified as significant under Section 10 of the DPDP Act. The government names an organisation, or a class of them, because of the volume, sensitivity or risk of the personal data it processes. It has extra duties, such as a Data Protection Officer in India.
How does the government decide who is a Significant Data Fiduciary?
The government decides by notification, after assessing relevant factors that Section 10 lists, including:
- the volume and sensitivity of the personal data processed;
- the risk to the rights of Data Principals;
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- the security of the State;
- public order.
The Act sets no fixed user count or turnover for SDF status. Large platforms and organisations in sectors that handle sensitive data, such as finance and health, are the most likely candidates, but only a notification makes it official.
Are you a Significant Data Fiduciary?
You are a Significant Data Fiduciary only if a government notification names you or a class you belong to. Until then, you are an ordinary Data Fiduciary. If you process large volumes of sensitive personal data, plan as though you could be named: the extra duties take time to set up.
What extra duties does a Significant Data Fiduciary have?
An SDF must meet every duty of a Data Fiduciary, plus these under Section 10 and Rule 13:
| Duty | What it involves | Source |
|---|---|---|
| Data Protection Officer | Based in India, represents the SDF, responsible to its board or governing body, point of contact for grievances | Section 10 |
| Independent data auditor | Appointed to evaluate the SDF's compliance with the Act | Section 10 |
| Data Protection Impact Assessment | Carried out every 12 months | Section 10, Rule 13 |
| Audit | Carried out every 12 months; significant observations reported to the Board | Section 10, Rule 13 |
| Algorithmic due diligence | Check that algorithmic software used for personal data does not put Data Principals' rights at risk | Rule 13 |
| Data localisation for specified data | Keep categories of personal data specified by the government within India | Rule 13 |
The Rule 13 duties apply from 13 May 2027, with the other business obligations in the DPDP Rules 2025.
What does a Data Protection Impact Assessment cover?
A Data Protection Impact Assessment describes the rights of the people affected and the purpose of processing, and assesses and manages the risk to their rights. In practice it starts from a record of what data you process, why and where, which is why a record of processing activities is the usual starting point.
What is the penalty for a Significant Data Fiduciary?
Breaching the additional SDF obligations can cost up to ₹150 crore. An SDF also faces the same penalties as any Data Fiduciary for its other duties, up to ₹250 crore for weak security safeguards. See DPDP Act penalties.
How GRC Flow helps
GRC Flow keeps a DPIA register alongside consent, request, breach and vendor registers, each entry with an owner, a due date and its evidence (see DPDP registers). Its risk register and data-flow map show where personal data goes, including every flow that leaves India.
Frequently asked questions
What is a Significant Data Fiduciary under the DPDP Act?
A Data Fiduciary, or class of Data Fiduciaries, that the central government notifies as significant under Section 10, based on factors such as the volume and sensitivity of the personal data it processes and the risk to people's rights. It has extra duties on top of those of every Data Fiduciary.
How do I know if my company is a Significant Data Fiduciary?
Only a government notification makes you one; there is no self-declaration and no fixed numeric threshold in the Act. Watch for notifications naming your organisation or its class, and assess your exposure if you process large volumes of sensitive data.
Does a Significant Data Fiduciary need a Data Protection Officer?
Yes. It must appoint a Data Protection Officer who is based in India, represents it under the Act, is responsible to its Board of Directors or similar governing body, and is the point of contact for grievance redressal.
How often must a Significant Data Fiduciary do a DPIA and audit?
Rule 13 of the DPDP Rules 2025 requires a Data Protection Impact Assessment and an audit every 12 months, with the significant observations reported to the Data Protection Board.
What is the penalty for a Significant Data Fiduciary?
Up to ₹150 crore for breaching the additional obligations of a Significant Data Fiduciary. Its other duties carry the same penalties as for any Data Fiduciary, up to ₹250 crore for weak security safeguards.
Sources
- PIB: Digital Personal Data Protection Rules, 2025
- KPMG India: DPDP Rules 2025 guidance
- Bar & Bench: MeitY notifies final DPDP Rules 2025
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.