Significant Data Fiduciary
A Data Fiduciary, or class of fiduciaries, that the Central Government notifies as significant because of the risk it poses.
A Significant Data Fiduciary is an organisation, or a class of organisations, that the Central Government has notified as high-risk because of the data it handles. It must meet extra duties on top of the ordinary ones.
Meaning of Significant Data Fiduciary
The Government considers the volume and sensitivity of the data, risk to Data Principals, possible impact on India's sovereignty and integrity, risk to electoral democracy, security of the State and public order. Notified fiduciaries must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits.
Section 10(1) of the DPDP Act lets the Central Government notify any Data Fiduciary, or any class of Data Fiduciaries, as a Significant Data Fiduciary (SDF). The decision is based on an assessment of relevant factors, which the Act lists as the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential impact on India's sovereignty and integrity, the risk to electoral democracy, the security of the State and public order. Size alone is not the test.
Status is not automatic. No organisation becomes an SDF just by being large. It happens through a notification, which can name a specific entity or a class, such as operators of large social media platforms or payment systems. Rules can also seek information from fiduciaries to help assess this; Rule 23 and the Seventh Schedule allow information to be called for the purpose of assessing whether to notify an entity as an SDF.
Once notified, Section 10(2) adds three groups of duties. The SDF must appoint a Data Protection Officer who is based in India, represents it under the Act, answers to the board of directors or similar body and is the point of contact for grievance redressal. It must appoint an independent data auditor. And it must carry out periodic Data Protection Impact Assessments, periodic audits and other prescribed measures.
Rule 13 turns these into specifics. At least once every twelve months from notification, the SDF must conduct a Data Protection Impact Assessment and an audit, and ensure that significant observations are furnished to the Board. It must exercise due diligence to verify that algorithmic software it uses is not likely to pose a risk to Data Principals' rights. It must also ensure that personal data specified by the Central Government is processed subject to restrictions so that the data and associated traffic data are not transferred outside India. The ordinary Chapter II duties continue to apply alongside these.
Examples of Significant Data Fiduciary
A very large payments platform or social network could be notified as a Significant Data Fiduciary and then face annual audits.
A payments platform handling transactions for crores of users is notified as an SDF. It appoints an India-based DPO reporting to its board, hires an external auditor, completes its first annual DPIA within the cycle and tests its fraud-scoring model for risk to users' rights.
A social media service with a very large user base is notified as a class. It reviews its recommendation algorithms, documents safeguards against exposure of personal data, and records that specified personal data is processed within India as the Central Government requires.
A large health-record platform expects to be notified. It runs a mock DPIA, builds an audit-ready evidence folder and discusses roles with its prospective auditor, so that the first formal cycle is not a scramble.
Why Significant Data Fiduciary matters
The Schedule sets a maximum penalty of ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary, separate from the ₹250 crore and ₹200 crore tiers for security and breach-notification failures. An SDF therefore faces stacked exposure. Beyond money, the Board's inquiry power under Section 27 and the possibility of a blocking direction under Section 37 after repeated penalties carry reputational and operational weight.
For other organisations, SDF rules are a signal of regulatory direction. Even if you are not notified, customers and regulators such as RBI, SEBI and IRDAI increasingly expect SDF-like practices, including annual assessments, an accountable privacy officer and documented algorithmic controls.
How it works in practice
- 1Watch for notifications from the Ministry of Electronics and Information Technology and assess early whether your sector, scale and data types resemble the factors in Section 10(1).
- 2Prepare an SDF readiness pack before any notification: data inventory, processing records, a draft DPIA template, vendor list, algorithm inventory and a list of data that might be affected by localisation.
- 3Select a Data Protection Officer based in India with real authority and a reporting line to the board, and confirm that she has no conflict of interest in running the business units she oversees.
- 4Engage an independent data auditor and plan the annual cycle: scoping, evidence collection, findings, remediation tracking and the report to the Board under Rule 13.
- 5Establish due diligence for algorithmic systems used to host, display, upload, modify, publish, transmit, store, update or share personal data, including testing for bias and unintended exposure.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming SDF status applies only to Big Tech. The notification can cover any fiduciary or class that meets the statutory factors.
Waiting for notification before preparing. DPIAs, audits and localisation controls need months of design and budget.
Treating the DPO as a part-time compliance clerk. The Act expects a person with authority who answers to the board.
Choosing an auditor who also designs your controls. Independence matters, so avoid conflicts.
Compliance tips
Run a self-assessment against the Section 10(1) factors each year and keep a note of the conclusion for your board.
Budget for a full audit cycle, and keep the DPIA and the audit findings tied to a remediation log that the board reviews.
Map data flows to identify any data a localisation direction might touch, and plan cloud regions and vendor contracts accordingly.
Align with sector regulators, since RBI, IRDAI or SEBI rules may demand stricter controls than the DPDP framework.
Common questions about Significant Data Fiduciary
Who decides whether a company is a Significant Data Fiduciary?
The Central Government, by notification under Section 10(1). It considers the volume and sensitivity of data, risk to Data Principals, effect on sovereignty, electoral democracy, State security and public order. A company cannot declare itself an SDF, and size alone is not the test.
What extra duties does an SDF have?
It must appoint an India-based Data Protection Officer and an independent data auditor, carry out DPIAs and audits at least once every twelve months, perform algorithmic due diligence and, where specified, keep certain data within India under Rule 13.
What is the penalty for SDF breaches?
The Schedule provides a maximum of ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary. Separate tiers, such as ₹250 crore for security failures, can apply too, depending on the facts.
Is a small start-up ever an SDF?
It is unlikely but not impossible, because the factors include sensitivity and risk, not just user count. A small firm processing very sensitive data at scale for a sensitive purpose could in theory be notified. Watch official notifications.