Significant Data Fiduciary Under the DPDP Act: Rules and Compliance

Significant Data Fiduciaries face enhanced obligations because their processing may create greater privacy, security, or public risks. This guide explains SDF classification, government assessment factors, DPO and audit requirements, DPIAs, technical governance duties, key differences from non-SDFs, and practical preparation steps.

Significant Data Fiduciaries face enhanced duties due to higher privacy, security, societal, or national risks. Requirements include senior privacy oversight, independent audits, recurring assessments, algorithmic due diligence, regulatory reporting, and possible data-transfer restrictions.

The main SDF provisions and Rule 13 are scheduled to commence on May 13, 2027. Data Security Council of India. 2025. “Insight Brief on Digital Personal Data Protection Rules 2025.” DSCI.

Significant Data Fiduciaries face stronger governance and evidence requirements than ordinary Data Fiduciaries.

• SDF status is assigned through a Central Government notification
• Company size alone does not automatically determine classification
• An India-based Data Protection Officer must report to senior governance
• Independent audits and DPIAs are required every 12 months
• Algorithmic and other technical measures require risk due diligence
• Certain notified data may be subject to localisation controls

Significant Data Fiduciary refers to a Data Fiduciary or class of Data Fiduciaries formally designated by the Central Government under Section 10 of the DPDP Act because its personal-data processing may create higher privacy, security, societal, or national risks.

Designation depends on factors such as data volume, sensitivity, potential harm to individuals, public order, national security, sovereignty, and electoral democracy. Ministry of Law and Justice. 2023. “The Digital Personal Data Protection Act, 2023.” Gazette of India.

Read more: Data Inventory for DPDP Compliance

Core governance requirements place privacy responsibility at senior leadership level and introduce independent oversight.

An SDF must:

• Appoint a Data Protection Officer based in India
• Make the DPO responsible to the board or similar governing body
• Use the DPO as the contact for grievance redressal
• Appoint an independent data auditor
• Define ownership for DPIAs, audits, remediation, and reporting
• Maintain policies, risk registers, decisions, and compliance evidence

The DPO role should have sufficient authority, access, resources, and independence to challenge high-risk processing decisions.

SDFs must assess whether their systems, technical controls, and algorithmic software could create risks to Data Principal rights.

Assessment areas should include:

• Automated decision-making and profiling
• AI models and training datasets
• Data-sharing and recommendation algorithms
• Access, storage, transmission, and deletion controls
• Processor and cloud-service dependencies
• Security weaknesses and misuse scenarios
• Cross-border data flows

Key governance duties require SDFs to demonstrate that privacy risks are identified, assigned, monitored, and corrected.

Practical duties include:

• Maintaining an updated personal-data inventory
• Mapping purposes, systems, processors, and transfers
• Tracking risk owners and remediation deadlines
• Reviewing high-risk projects before launch
• Testing security and privacy controls
• Reporting unresolved material risks to leadership
• Preserving evidence for auditors and the Board

Read also: Why Data Subject Requests

Any Data Fiduciary or defined class of Data Fiduciaries may be classified as an SDF when its processing creates significant risk or broader public impact.

Potential candidates may include entities that:

• Process large volumes of personal data
• Handle highly sensitive or high-impact information
• Operate essential or widely used digital services
• Use profiling, monitoring, AI, or complex algorithms
• Influence large populations or public decision-making
• Create risks involving national security or public order

Significant Data Fiduciaries must follow all standard Data Fiduciary duties along with stricter governance and oversight requirements. These include conducting a DPIA and compliance audit every 12 months, reporting significant findings to the Data Protection Board, reviewing risks from algorithms and automated systems, and following any government-imposed data localisation rules.

These obligations strengthen accountability, independent assurance, technical oversight, and senior-management reporting.

Read a lso: Simplifying DPDP Compliance: The Power of a Privacy Maturity Report

An SDF carries additional statutory governance, audit, and risk-assessment responsibilities.

• General DPDP Duties: Both SDFs and non-SDFs must follow core DPDP requirements.
• India-Based DPO: Mandatory for SDFs, but not for every non-SDF.
• Independent Auditor: SDFs must appoint an independent data auditor.
• Annual DPIA: SDFs must conduct a DPIA every year.
• Compliance Audit: Annual compliance audits are required for SDFs.
• Algorithmic Due Diligence: SDFs must assess risks from algorithms and automated systems.
• Board Reporting: Significant findings must be reported to senior governance or the Board.
• Data Localisation: SDFs may face special restrictions for specified personal data.

Read more: Data Discovery Under the DPDP Act

The Central Government decides SDF status by assessing the nature, scale, sensitivity, and potential consequences of personal-data processing.

Section 10 identifies the following factors:

• Volume and sensitivity of personal data
• Risk to Data Principal rights
• Impact on India’s sovereignty and integrity
• Risk to electoral democracy
• Security of the State
• Public order

The assessment is conducted by an authorised MeitY officer, but the final classification must be communicated through an official notification. This risk-based model means two businesses in the same sector may not necessarily receive identical treatment.

DPIAs help Significant Data Fiduciaries identify privacy risks before or during high-risk processing and decide how those risks should be reduced.

The assessment should cover:

• Purpose and need for processing
• Personal data and affected individuals
• Data flows, vendors, and technologies
• Possible harm to Data Principals
• Existing and planned safeguards
• Remaining risks and approval decisions
• Action owners and review dates

ISACA. 2022. “A PDCA Approach to Conducting a DPIA.” ISACA. The guidance treats DPIAs as lifecycle-based assessments that should begin before high-risk processing occurs. For SDFs, the annual requirement should supplement, not replace project-level risk reviews.

Read also: What Is Personal Data Under the DPDP Act?

Potential Significant Data Fiduciaries should begin preparing before formal designation because the required governance, audit, and technical controls may take time to establish. Early preparation helps organisations identify gaps, assign responsibilities, and maintain evidence before enhanced obligations become applicable.

Preparation should include:

• Review data scale, sensitivity, and impact
• Appoint India-based privacy leadership
• Set up DPIA and audit processes
• List AI and automated systems
• Map data transfers and storage locations
• Include processors in compliance reviews
• Test controls and report major gaps
• Maintain policies, reports, and evidence

Significant Data Fiduciary status introduces higher expectations for privacy governance, independent assurance, technical risk assessment, and accountability. Businesses likely to process data at scale should prepare early by strengthening DPO oversight, DPIAs, audits, algorithmic governance, data mapping, and evidence management rather than waiting for formal notification.

Explore SecuRetain’s learning platform and our all courses to build practical knowledge in cybersecurity, compliance, risk management, audit, business continuity, disaster recovery, fraud management, and employee awareness training.

You can also visit our website to explore how SecuRetain helps professionals and organizations strengthen skills, improve awareness, and support continuous learning in a structured and scalable way.