Significant Data Fiduciary Under the DPDP Act: Who Is Covered and What Changes

Hero Summary

A Significant Data Fiduciary (SDF) is a data fiduciary that the Central Government designates, under Section 10 of India's DPDP Act, 2023, as carrying a higher level of risk because of factors such as the volume and sensitivity of the personal data it processes. SDFs face stronger duties: the Government of India's explainer on the DPDP Rules says they must conduct independent audits and impact assessments, follow stricter checks when using new or sensitive technologies, and in some cases follow government directions on restricted categories of data, including local storage where needed. The Act also requires an SDF to appoint a Data Protection Officer based in India.

Executive Summary

Most data fiduciaries must meet the Act's baseline duties. Some are expected to meet more. Whether an organization is an SDF is not self-declared: the Government designates it, considering factors in the Act. This guide explains how designation works, the additional obligations, who is likely to be affected, how to prepare in advance, and how SDF duties relate to the baseline program. Because designation criteria and the details of SDF duties are set out in the Act and Rules and may be supplemented by notifications, confirm the current position in the official text.

What is a Significant Data Fiduciary? {#what}

A Significant Data Fiduciary is a data fiduciary or class of data fiduciaries notified by the Central Government on the basis of an assessment of relevant factors. The idea is proportionality: organizations whose data processing carries greater risk to individuals, or to the country, are held to higher standards.

How designation works {#designation}

Under Section 10 of the Act, the Central Government may notify any data fiduciary, or class of data fiduciaries, as significant on the basis of factors including:

• the volume and sensitivity of personal data processed;
• the risk to the rights of data principals;
• the potential impact on the sovereignty and integrity of India;
• the risk to electoral democracy;
• security of the State; and
• public order.

The designation is therefore a government decision, not a threshold you can calculate yourself. Organizations that process large volumes of data, sensitive categories such as health or financial data, or data at national scale should plan on the basis that designation is possible.

The additional duties {#duties}

According to the Act and the Government of India's explainer on the Rules, an SDF must, in addition to the baseline duties:

Duty	What it means
Appoint a Data Protection Officer	The Act requires an SDF to appoint a DPO who is based in India, represents the SDF under the Act, reports to the board or equivalent governing body, and is the point of contact for grievance redressal
Appoint an independent data auditor	An independent auditor evaluates the SDF's compliance with the Act
Conduct data protection impact assessments	Periodic assessments of the risks of processing, including the rights of data principals, purposes, and measures to manage risk
Carry out periodic audits	Regular audits of compliance
Apply stricter checks to new or sensitive technologies	The explainer notes that SDFs must follow stricter checks when using new or sensitive technologies
Follow government directions on restricted categories of data	The explainer notes that in some cases this includes local storage of certain data

The Act also allows the Government to prescribe further measures for SDFs.

Who is likely to be affected {#who}

The Act does not list named organizations. Considering the statutory factors, those most likely to be considered include large consumer-facing platforms, major financial institutions, health data holders, telecom and large e-commerce players, and organizations that process very large volumes of personal data or sensitive categories. Smaller organizations are unlikely to be designated, but they may be suppliers to SDFs and will face contractual expectations as a result.

How to prepare {#prepare}

1. Assess your exposure. Review the statutory factors against your data volumes, categories, and sector. Treat designation as a realistic possibility if you are large or handle sensitive data.
2. Build the baseline first. SDF duties sit on top of the baseline duties; weak foundations will make the additional duties harder. See the DPDP Compliance Checklist.
3. Plan the DPO role. Decide who could fill it, ensure the person is India-based and has real access to the board, and avoid conflicts of interest.
4. Prepare for independent audit. Keep evidence organized — policies, records, assessments, testing results — so an auditor can verify it.
5. Set up an impact assessment process that can be applied to new products, systems, and uses of data, including AI and other new technologies.
6. Review localisation exposure. Know where your data is stored and how hard it would be to keep certain categories in India. See Cross-Border Data Transfers Under DPDP.
7. Engage the board. Make sure directors understand the exposure and the penalty framework, which reaches ₹250 crore for failing to maintain reasonable security safeguards.

How SDF duties relate to baseline duties {#baseline}

An SDF is still a data fiduciary: it must meet notice, consent, security, breach, rights, retention, children's data, and vendor obligations like everyone else. SDF duties add oversight and assurance layers — a DPO, an independent auditor, impact assessments, and potentially data localisation. For breach duties see Data Breach Response Under DPDP, and for vendors see Third-Party and Vendor Risk Management Under DPDP.

How Threat ResQ fits {#threat-resq-fit}

PrivacyIQ, Threat ResQ's privacy management platform, provides a data inventory, explainable findings mapped to DPDP obligations, a technical readiness view per obligation, evidence, and governance records that support audit preparation. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status. getTRAC automates evidence collection and control mapping across frameworks, and Threat ResQ's Compliance Consulting service supports regulatory readiness.

FAQ {#faq}

What is a Significant Data Fiduciary? A data fiduciary or class of data fiduciaries that the Central Government notifies as carrying higher risk, based on factors such as the volume and sensitivity of personal data processed, risk to individuals' rights, and impact on the security of the State and public order.

Can an organization decide it is an SDF? No. Designation is made by the Central Government by notification, though organizations should assess whether they may be designated.

What extra duties does an SDF have? Appointing an India-based Data Protection Officer, appointing an independent data auditor, conducting data protection impact assessments and periodic audits, applying stricter checks to new or sensitive technologies, and following government directions on restricted data categories, including local storage where needed.

Does a small business need to worry about SDF rules? Unlikely to be designated itself, but it may be a vendor to an SDF and face contractual requirements as a result.

When do SDF obligations apply? The DPDP Rules, notified on 14 November 2025, introduced an eighteen-month phased compliance period, placing most obligations around May 2027. Confirm exact dates and any designation notifications in the official sources.