Significant Data Fiduciary status
In short
A Significant Data Fiduciary is a Data Fiduciary, or a class of Data Fiduciaries, that the Central Government notifies as such under Section 10(1) of the DPDP Act 2023. It is not a threshold an organisation crosses on its own. It is a designation the government makes.
Designation is based on factors set out in Section 10(1), including the volume and sensitivity of personal data processed, the risk to the rights of the Data Principal, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State and public order.
01What designation adds, under the Act
Section 10(2) attaches three obligations to a Significant Data Fiduciary. It must appoint a Data Protection Officer who is based in India, is responsible to the board of directors or similar governing body, and is the point of contact for the grievance redressal mechanism. It must appoint an independent data auditor to evaluate compliance. And it must undertake periodic Data Protection Impact Assessment, periodic audit and such other measures as are prescribed.
02What Rule 13 prescribes
| Reference | Obligation |
|---|---|
| 13(1) | Once in every period of twelve months from designation, undertake a Data Protection Impact Assessment and an audit for effective observance of the Act and the Rules |
| 13(2) | Cause the person carrying out that assessment and audit to furnish a report of significant observations to the Board |
| 13(3) | Observe due diligence to verify that technical measures, including algorithmic software used for hosting, display, upload, modification, publication, transmission, storage, updating or sharing of personal data, are not likely to pose a risk to the rights of Data Principals |
| 13(4) | Ensure that personal data specified by the Central Government, on the recommendation of a committee it constitutes, together with the traffic data pertaining to its flow, is not transferred outside India |
Rule 13(2) is the sharpest of the four. The audit report does not stay internal. Significant observations go to the Board, which means the audit is a filing rather than a management exercise.
Rule 13(4) is the second. It is a localisation restriction that does not yet have content: the categories of personal data it covers are to be specified by the Central Government on the recommendation of a committee that includes officials of the Ministry of Electronics and Information Technology. Until that specification is published, the scope of the restriction is unknown.
03Who is likely to be designated
No list of Significant Data Fiduciaries has been published. Commentary consistently expects organisations in financial services, healthcare, telecommunications, large consumer platforms and entities operating at national scale to be within scope, and that expectation is reasonable on the Section 10(1) factors. It remains commentary.
The defensible planning position is to prepare for the obligation set rather than to assume the designation. The four Rule 13 obligations take time to stand up: an annual DPIA and audit cycle, an auditor engagement, an algorithmic due diligence process and a data flow map capable of supporting a localisation restriction whose scope is not yet defined.
04Common questions
Can an organisation self declare as a Significant Data Fiduciary?
No. Designation is by the Central Government under Section 10(1). An organisation can prepare for the obligations, but it cannot confer the status on itself.
Has the list been published?
No list has been published as at the last review date of this page. Verify against MeitY notifications before relying on this.
Does every Data Fiduciary need a Data Protection Officer?
The Section 10(2) requirement for a DPO based in India applies to Significant Data Fiduciaries. Rule 9 separately requires every Data Fiduciary to publish the business contact information of the Data Protection Officer, if applicable, or of a person who can answer questions about the processing.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.