Section 10: Additional Obligations of Significant Data Fiduciary

Quick summary

What Section 10 says

• Sub-section (1) — the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary, based on an assessment of relevant factors including (a) the volume and sensitivity of personal data processed; (b) risk to the rights of Data Principals; (c) potential impact on the sovereignty and integrity of India; (d) risk to electoral democracy; (e) security of the State; and (f) public order.
• Sub-section (2)(a) — a notified Significant Data Fiduciary shall appoint a Data Protection Officer who (i) represents the Significant Data Fiduciary under the Act, (ii) is based in India, (iii) is responsible to the Board of Directors or similar governing body, and (iv) is the point of contact for the grievance redressal mechanism.
• Sub-section (2)(b) — a notified Significant Data Fiduciary shall appoint an independent data auditor to carry out data audits evaluating the Significant Data Fiduciary's compliance.
• Sub-section (2)(c) — a notified Significant Data Fiduciary shall undertake (i) periodic Data Protection Impact Assessments — a process describing Data Principals' rights, the purpose of processing, and an assessment and management of the risk to their rights; (ii) periodic audits; and (iii) any other prescribed measures.

Breaking it down

Sub-section (1) weighs six factors when deciding who to designate:

• Volume & sensitivity of data
• Risk to Data Principals' rights
• Sovereignty & integrity of India
• Electoral democracy
• Security of the State
• Public order

Once notified, three extra duties apply:

• Sub-s. (2)(a)

  India-based DPO

  Represents the fiduciary, answers to the board, and handles grievances.

• Sub-s. (2)(b)

  Independent auditor

  Evaluates compliance through periodic data audits.

• Sub-s. (2)(c)

  Impact assessments

  Recurring DPIAs and audits, plus any other prescribed measures.

Significant Data Fiduciary status isn't self-declared. It's a formal Central Government notification under sub-section (1), based on the listed factors — an organisation doesn't decide for itself that it's “significant” and voluntarily opt into this tier; equally, it can't assume it's exempt just because it feels like an ordinary business, if the government's notification covers its class.

The six factors combine business-risk and national-interest considerations. Volume/sensitivity of data and risk to Data Principals are the kind of factors a typical data protection law would use; sovereignty, electoral democracy, State security and public order are distinctly India-specific additions, meaning a platform's political or civic footprint — not just its data volume — can be part of why it gets designated.

The DPO role has four specific, non-negotiable features. India-based, board-level accountability, formal representation of the Fiduciary under the Act, and being the actual point of contact for grievances — a compliance officer who ticks only some of these boxes (say, based outside India, or without real board-level standing) doesn't satisfy sub-section (2)(a).

Audits have to be independent, not internal. Sub-section (2)(b) requires the data auditor evaluating compliance be independent — an internal team marking its own work doesn't meet this requirement, distinguishing it from a general internal-audit function.

Impact Assessments are recurring, not one-time. Sub-section (2)(c)(i)'s periodic Data Protection Impact Assessment has to keep describing Data Principals' rights, the processing purpose, and risk assessment/management on an ongoing basis, not as a single document produced once at launch and shelved.

Why this section matters

Most of Chapter II applies uniformly to every Data Fiduciary. Section 10 is where the Act recognises that scale and sensitivity change the risk profile enough to warrant a heavier compliance structure — comparable to how larger or higher-risk organisations face additional governance requirements under many other regulatory regimes. For an organisation that might be designated, the practical question isn't just “are we compliant with Chapter II” but “could we stand up a DPO, an independent auditor, and a recurring impact-assessment process on short notice.”

Real-world example

Who needs to care about this section

• Large-scale platforms handling sensitive or high-volume personal data — financial services, healthcare, large social or communication platforms — are the most likely candidates for Significant Data Fiduciary notification.
• Boards and senior leadership — the India-based, board-accountable DPO requirement in sub-section (2)(a) is a governance change, not just a hiring decision.
• Internal audit and compliance functions — sub-section (2)(b)'s independence requirement means the audit function itself needs restructuring, not just an added checklist.

Common questions

Related sections