A Significant Data Fiduciary (SDF) is a fiduciary, or class of fiduciaries, the government notifies under section 10(1), considering factors such as the volume and sensitivity of data and risk to people's rights. None has been notified yet. An SDF must appoint an India-based DPO and an independent data auditor, and run a DPIA and data audit every 12 months (Rule 13). The penalty ceiling is ₹150 crore.
Key takeaways
- No Significant Data Fiduciary has been notified as of 13 November 2026.
- Section 10 and Rule 13 come into force on 13 May 2027 with the other core obligations.
- An SDF adds five duties: DPO in India, independent data auditor, yearly DPIA and data audit, algorithmic due diligence, and localisation of specified data.
- Breaching SDF obligations carries a penalty of up to ₹150 crore; every ordinary fiduciary obligation, and its own penalty ceiling, still applies.
- If you process large volumes of sensitive data, build the DPIA method and audit evidence now.
Most Data Fiduciaries carry the same set of obligations, whatever their size. The Act adds one tier on top: the Significant Data Fiduciary. A fiduciary in that tier must build a privacy governance function with a named officer, an independent auditor and a yearly assessment cycle reported to the Board.
No organisation has been designated yet. But the duties are set out in section 10 and Rule 13, and the work to meet them typically takes longer than most. If your business processes large volumes of sensitive data, it is worth understanding the tier now.
What is a significant data fiduciary?
Section 10(1) lets the central government notify "any Data Fiduciary or class of Data Fiduciaries" as a Significant Data Fiduciary, based on an assessment of relevant factors. The Act lists six factors the government may consider, without limiting itself to them.
| Factor in section 10(1) | What it points to |
|---|---|
| (a) Volume and sensitivity of personal data processed | Scale of the user base and the kind of data: financial, health, identity, children's data |
| (b) Risk to the rights of Data Principals | How much harm misuse or a breach could do to individuals |
| (c) Potential impact on the sovereignty and integrity of India | Data or processing with national significance |
| (d) Risk to electoral democracy | Platforms that shape political information or reach voters at scale |
| (e) Security of the State | Data that could affect national security if exposed |
| (f) Public order | Processing that could affect public order |
Because the government can notify a class, designation may come by sector or by type of platform rather than company by company. There is no published threshold of users or turnover, so do not assume you are outside the tier just because you are below a number someone has suggested.
Has any SDF been notified yet?
No. As of today, 13 November 2026, no Data Fiduciary or class has been notified as significant. Section 10 and Rule 13 sit in the final commencement phase, which starts on 13 May 2027, together with the core obligations every fiduciary must meet. The enforcement date guide sets out the phases.
What would change this is a notification under section 10(1). Under Rule 13(1), the yearly DPIA and audit cycle runs from the date a fiduciary is notified, or included in a notified class. So an organisation designated in, say, the second half of 2027 would need its first DPIA and data audit done within 12 months of that date. That is not long to set up a process from nothing.
What does a significant data fiduciary have to do?
An SDF must meet every obligation that applies to an ordinary fiduciary, from notice and consent to security safeguards and breach intimation. Section 10(2) and Rule 13 then add five more.
Represents the SDF, answers to the board of directors, is the point of contact for grievances
Evaluates the SDF's compliance with the Act
Significant observations reported to the Board
Check that algorithmic software does not put data principals' rights at risk
Personal data the government specifies, on a committee's advice, stays in India
1. A Data Protection Officer based in India
Section 10(2)(a) requires the DPO to represent the SDF under the Act, be based in India, be an individual responsible to the board of directors or similar governing body, and be the point of contact for the grievance redressal mechanism. Rule 9 requires the DPO's business contact to be published prominently on the website or app and included in every response to a rights communication.
The reporting line matters. A DPO who reports only to the general counsel or the head of security may not satisfy "responsible to the Board of Directors". Plan for direct, documented reporting to the board or a board committee.
2. An independent data auditor
Section 10(2)(b) requires an independent data auditor to carry out a data audit and evaluate the SDF's compliance with the Act. In our view, independence means the auditor should not be auditing controls it designed or runs. If a firm helps you build your programme, use a different firm to audit it.
3. A DPIA and a data audit every 12 months
Section 10(2)(c) requires a periodic Data Protection Impact Assessment and a periodic data audit. The DPIA must describe the rights of Data Principals and the purpose of processing, and assess and manage the risk to those rights. The DPDP (Removal of Difficulties) Order, 2026, issued on 5 October 2026, changed the wording of section 10(2)(c)(ii) from "periodic audit" to "periodic data audit". The new wording lines up with the independent data auditor in section 10(2)(b).
Rule 13(1) sets the frequency: once in every 12 months from notification. Rule 13(2) requires the SDF to have the person who carries out the DPIA and audit give the Board a report of significant observations. Expect the Board to read those reports, so findings need owners and fixes.
4. Algorithmic due diligence
Rule 13(3) requires an SDF to observe due diligence to verify that technical measures, "including algorithmic software", used for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing personal data are not likely to pose a risk to the rights of Data Principals. In practice, keep an inventory of the systems and models that make or shape decisions using personal data, test them for risks to individuals, and record the results.
5. Localisation of specified data
Under Rule 13(4), personal data that the government specifies, on the recommendation of a committee it constitutes, must be processed so that the data and the traffic data about its flow are not transferred outside India. No such list has been notified. This sits apart from the general cross-border transfer regime, which allows transfers except to restricted countries, of which none has been notified.
DPO or contact person: what is the difference?
Every fiduciary has to name someone. Only an SDF must appoint a DPO with a defined role.
| Every Data Fiduciary | Significant Data Fiduciary | |
|---|---|---|
| Who | A DPO, if it has one, or a person able to answer questions about processing | A Data Protection Officer, an individual |
| Source | Section 8(9), Rule 9 | Section 10(2)(a), Rule 9 |
| Location | Not specified | Based in India |
| Reports to | Not specified | Board of directors or similar governing body |
| Grievances | Effective grievance redressal required (section 8(10)) | DPO is the point of contact for grievance redressal |
What is the penalty for breaching SDF obligations?
The Schedule to the Act sets a ceiling of ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary under section 10. The Board decides the amount after an inquiry, considering the factors in section 33(2), such as the nature, gravity and duration of the breach, the type of data affected, whether it was repeated, and how quickly it was mitigated.
The SDF ceiling sits alongside the others. An SDF that fails to take reasonable security safeguards faces up to ₹250 crore for that breach, and up to ₹200 crore for failing to intimate a breach. See DPDP Act penalties for the full Schedule.
How to prepare if you might be designated
If your organisation processes personal data at large scale, handles sensitive categories, or runs a platform with wide public reach, prepare as if designation is possible. Most of the work also improves your ordinary compliance.
Write down where you stand on each factor and review it when your scale or products change
An India-based individual with a direct line to the board or a board committee
Test the method, the templates and who signs off, before it becomes a duty
Evidence for each obligation, so an independent data auditor can test it
Models and rules that use personal data, with risk tests and records
So you can act quickly if specific data must stay in India
Do the ordinary work first
An SDF's DPIA and data audit will test the same controls every fiduciary must have from 13 May 2027. A strong baseline programme is the best preparation for designation.
What to do next
- Complete the core programme using the compliance checklist and the implementation roadmap.
- Record your position against each section 10(1) factor and brief your board on the possibility of designation.
- Pilot a DPIA on one high-risk processing activity this quarter.
- Line up a DPO candidate and an independent auditor you could engage quickly.
- Watch for a section 10(1) notification and any Rule 13(4) list, and review your plan when either appears.
We run DPIAs, prepare audit evidence and support DPOs as part of our managed privacy office, working alongside your counsel.
Frequently asked questions
Has any significant data fiduciary been notified under the DPDP Act?
No. As of 13 November 2026 the government has not notified any Data Fiduciary or class of fiduciaries as significant. Section 10 and Rule 13 come into force on 13 May 2027, and designation will be by notification.
Who will be a significant data fiduciary?
The government decides by notification, considering the factors in section 10(1): volume and sensitivity of personal data, risk to the rights of Data Principals, potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State and public order. It can notify individual fiduciaries or a whole class.
Is a DPO mandatory under the DPDP Act?
Only for a Significant Data Fiduciary, under section 10(2)(a). The DPO must be based in India, be responsible to the board of directors or similar governing body, and be the point of contact for grievances. Every other fiduciary must publish the business contact of a DPO or a person who can answer questions about its processing.
What is a DPIA under the DPDP Act?
A Data Protection Impact Assessment under section 10(2)(c)(i) describes the rights of Data Principals and the purpose of processing, and assesses and manages the risk to those rights. Rule 13 requires an SDF to carry one out every 12 months and report significant observations to the Board.
What is the penalty for a significant data fiduciary?
Breach of the additional SDF obligations in section 10 can attract a penalty of up to ₹150 crore under the Schedule. An SDF also remains liable for its other obligations, such as up to ₹250 crore for failing to take reasonable security safeguards.
Does an SDF have to store data in India?
Only the personal data the government specifies, on the recommendation of a committee, under Rule 13(4). That data and the traffic data about its flow must not be transferred outside India. No such list has been notified yet.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.