Section 10: Additional Obligations of Significant Data Fiduciary

Statutory Text (Official Gazette)

(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including—

• (a) the volume and sensitivity of personal data processed;
• (b) risk to the rights of Data Principal;
• (c) potential impact on the sovereignty and integrity of India;
• (d) risk to electoral democracy;
• (e) security of the State; and
• (f) public order.

(2) The Significant Data Fiduciary shall:

• (a) appoint a Data Protection Officer who shall—
  • (i) represent the Significant Data Fiduciary under the provisions of this Act;
  • (ii) be based in India;
  • (iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
  • (iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
• (b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
• (c) undertake the following other measures, namely:—
  • (i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
  • (ii) periodic data audit; and
  • (iii) such other measures, consistent with the provisions of this Act, as may be prescribed.

Amendment note: The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated October 5, 2026, in force on its publication in the Gazette, reported as October 6 or 7, 2026) replaced “periodic audit” in clause (c)(ii) with “periodic data audit”. This makes clear that the periodic audit is a data audit, the same kind of audit as in clause (b), not a financial or general IT audit. Section 10 itself is not yet in force and is expected to apply from May 13, 2027.

What Section 10 Means in Plain English

Not every small business or startup is an SDF. The Central Government designates certain companies as Significant Data Fiduciaries based on scale, sensitivity of data, or national importance (e.g. large banks, telecom operators, social media platforms, major healthcare networks, large fintech platforms).

If designated as an SDF, your company must fulfill three strict corporate governance duties:

1. Mandatory India-based DPO: You must hire or appoint a Data Protection Officer physically located in India who reports directly to the Board of Directors.
2. Independent external data audits: You cannot rely solely on internal compliance teams. An independent data auditor must inspect your data handling operations.
3. Periodic DPIAs (Data Protection Impact Assessments): You must assess the risks your processing poses to users’ rights and how you manage them.

Extra Duties Under Rule 13

Rule 13 of the DPDP Rules 2025 (in force from May 13, 2027) adds:

• Yearly DPIA and audit: Once every 12 months from being notified as an SDF, with a report of significant findings sent to the Board.
• Algorithm checks: Due diligence that algorithmic software used to host, display, share or store personal data is not likely to harm users’ rights.
• Possible data localisation: Personal data that the government specifies, on a committee’s advice, must not be transferred outside India, along with the traffic data about its flow.

Engineering & Governance Checklist

• Track SDF notification criteria: Monitor MeitY notifications to assess whether your data volume or sector triggers SDF classification.
• Establish DPIA templates: Create technical documentation procedures for new features that collect sensitive biometric, financial, or behavioral data.
• Designate DPO contact infrastructure: Publish dedicated DPO contact routes for statutory communications and Board interactions.