Rule 13: Additional Obligations of Significant Data Fiduciary

Quick summary

What Rule 13 says

• At least once every twelve months from being notified as a Significant Data Fiduciary (or being included in a notified class), it must undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and Rules.
• It must cause the person carrying out the assessment and audit to furnish the Board a report containing significant observations from them.
• It must observe due diligence to verify that algorithmic software it uses (for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data) is not likely to pose a risk to Data Principals' rights.
• It must ensure that personal data specified by the Central Government (on a constituted committee's recommendation) is processed subject to the restriction that the data and associated traffic data's flow is not transferred outside India.

Breaking it down

Four distinct obligations, each aimed at a different kind of risk that scale creates:

Annual, not one-time, self-assessment. The Data Protection Impact Assessment and audit cycle repeats every twelve months — this is an ongoing governance rhythm, not a one-time certification exercise done once and filed away.

The Board gets visibility into your findings, not just confirmation you did the assessment. It's not enough to complete the audit privately; “significant observations” from it must be reported to the Board — meaning problems the audit surfaces can't simply stay internal.

Algorithms are explicitly in scope. This is one of the few places in the DPDP framework that names algorithmic software specifically — recommendation engines, ranking systems, automated moderation tools — requiring due diligence that they don't pose a risk to Data Principals' rights, not just that they work as intended commercially.

Data localisation is conditional, not automatic. The Rule doesn't itself list which data categories can't leave India — it creates the mechanism (a government-specified list, based on a committee's recommendation) that a Significant Data Fiduciary then has to comply with once triggered.

Why this rule matters

Significant Data Fiduciary status comes with real scale and real risk — these are the organisations whose data practices, algorithms and cross-border flows can affect the largest number of people at once. Rule 13 is where the extra trust placed in that scale is matched with extra, recurring accountability.

Real-world example

Who needs to care about this rule

• Organisations notified (or expecting to be notified) as a Significant Data Fiduciary — typically large-scale processors of sensitive or high-volume personal data.
• Data science and algorithmic-risk teams, who now have an explicit compliance touchpoint.
• Cross-border infrastructure and data-residency teams, who need to track government-specified localisation requirements.

Common questions

Related rules