Significant Data Fiduciary Under DPDP Act: DPO, DPIA, Annual Audit, Algorithms, Data Localisation & 2027 Deadline

Cyber Law • DPDP Act • Data Governance • Board Compliance • Privacy Risk

What is a Significant Data Fiduciary under the DPDP Act?

A Significant Data Fiduciary (SDF) is a Data Fiduciary that the Central Government specifically notifies, either individually or as part of a class, under Section 10 of the Digital Personal Data Protection Act, 2023. SDF status is important because it adds a second layer of governance obligations over and above the ordinary duties applicable to Data Fiduciaries.

The most important compliance point in August 2026 is timing. The SDF regime is enacted, but the substantive Section 10 obligations and the corresponding operational requirements in Rule 13 of the Digital Personal Data Protection Rules, 2025 are part of the eighteen-month commencement phase scheduled for 13 May 2027.

Businesses that could plausibly fall within the Government’s SDF designation factors should therefore treat 2026–27 as an implementation runway rather than wait for a notification to begin building DPO, audit, DPIA and algorithmic-risk processes.

For the broader commencement map, see DPDP Act Compliance in India: 2025 Rules, 2026–27 Timeline, Consent, Data Breaches, Children’s Data and Penalties.

Quick legal answer

An organisation does not become an SDF merely because it crosses a self-assessed turnover, user or data-volume threshold.
SDF status arises through a Central Government notification under Section 10(1).
The Government may consider volume and sensitivity of personal data, risks to Data Principal rights, sovereignty and integrity, electoral democracy, security of the State and public order.
An SDF must appoint a Data Protection Officer based in India who is responsible to the board of directors or similar governing body.
An SDF must appoint an independent data auditor.
Rule 13 requires a Data Protection Impact Assessment and audit once every twelve months from the date of SDF notification or inclusion in a notified class.
Significant observations from the DPIA and audit must be furnished to the Data Protection Board.
SDFs must perform due diligence on algorithmic and other technical measures used in processing so that they are not likely to pose risks to Data Principal rights.
Specified categories of personal data and related traffic data may become subject to India-localisation restrictions by Government action under Rule 13.
The principal SDF obligations are scheduled to commence on 13 May 2027, subject to any later statutory notification altering the position.

SDF status is by Government designation, not automatic self-classification

Section 10(1) uses a notification model. The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary after assessing relevant factors.

This means that a business should distinguish two questions:

Are we likely to be a candidate for future SDF designation?
Have we actually been notified as an SDF?

The first is an internal risk-assessment question. The second is a legal-status question determined by the Government notification. A company should not publicly declare itself exempt merely because no numerical threshold appears to apply to it, and it should not state that it is legally an SDF unless the relevant notification actually applies.

Section 10(1): factors the Government may consider

The statutory factors include:

volume of personal data processed;
sensitivity of personal data processed;
risk to the rights of Data Principals;
potential impact on the sovereignty and integrity of India;
risk to electoral democracy;
security of the State; and
public order.

The list is not drafted as a simple numerical test. A Data Fiduciary may attract regulatory attention because of scale, sensitivity, systemic influence or public-interest risk even where conventional business metrics do not tell the full story.

Primary statutory source: Section 10, Digital Personal Data Protection Act, 2023 — India Code.

Who is more likely to fall within an SDF risk profile?

The Act does not pre-designate industries. Nevertheless, organisations with the following characteristics should conduct SDF-readiness analysis early:

very large Indian user or customer bases;
processing of high-volume identity, financial, health, biometric or behavioural data;
large digital platforms whose processing can materially affect individuals at scale;
financial, telecom, insurance, healthcare or identity ecosystems with significant personal-data concentration;
businesses using extensive profiling, automated decision-making or algorithmic ranking affecting users;
platforms with political, civic or electoral influence;
entities with national-security, public-order or critical-infrastructure implications;
large data aggregators or intermediaries combining datasets across sources; and
organisations whose breach or misuse could create systemic rather than isolated harm.

This is a risk-readiness list, not a legal designation list. The final legal trigger remains Government notification.

When do the SDF provisions become operative?

The DPDP framework uses phased commencement. The commencement notification dated 13 November 2025 places Sections 7 to 10 within the group scheduled to come into force eighteen months after publication. The final DPDP Rules likewise provide that Rules 3, 5 to 16, 22 and 23 commence eighteen months after publication.

Accordingly, the principal Section 10 and Rule 13 SDF obligations are scheduled for 13 May 2027.

This distinction matters. A 2026 board paper should say that the organisation is preparing for scheduled SDF obligations, not that every Section 10 obligation is already legally enforceable today.

Official Rules: Digital Personal Data Protection Rules, 2025 — MeitY Gazette.

Section 10(2)(a): appoint a Data Protection Officer based in India

An SDF must appoint a Data Protection Officer (DPO). Section 10 makes the governance position unusually clear.

The DPO must:

represent the Significant Data Fiduciary under the Act;
be based in India;
be an individual responsible to the board of directors or similar governing body; and
act as the point of contact for the grievance-redressal mechanism under the Act.

The DPO is therefore not merely a mailbox owner or junior compliance executive. The statute contemplates a governance function with direct accountability to the organisation’s highest decision-making body.

DPO versus ordinary privacy contact: do not confuse the two

Every Data Fiduciary will have contact-information obligations under the general DPDP framework once the relevant provisions commence. An SDF, however, has a specific statutory duty to appoint a DPO meeting Section 10 requirements.

Issue	Ordinary Data Fiduciary contact	SDF Data Protection Officer
Statutory basis	General contact / grievance framework	Section 10(2)(a)
Must be titled DPO?	Not necessarily	Yes, statutory DPO function
Must be based in India?	Not stated as a universal rule for every contact person	Yes
Board accountability	Not necessarily direct	Responsible to board or similar governing body
Role in SDF governance	General query handling	Statutory representation, governance and grievance point of contact

What should an SDF DPO charter contain?

A defensible DPO charter should cover:

reporting line to the board or governing body;
independence from functions whose decisions the DPO reviews;
access to processing inventories and risk registers;
authority to escalate serious privacy risk;
coordination with information security, legal, audit and compliance teams;
rights-request and grievance oversight;
breach governance and regulatory coordination;
vendor and processor oversight;
DPIA methodology ownership;
independent-audit coordination;
board reporting frequency; and
documented conflict-of-interest controls.

Using the title “DPO” without adequate authority, access and independence can create the appearance of compliance without the operating substance.

Section 10(2)(b): appoint an independent data auditor

An SDF must appoint an independent data auditor to evaluate compliance with the DPDP Act.

Independence is central. The auditor should not simply validate the same controls it designed and operates without appropriate safeguards. The audit programme should be capable of testing evidence, identifying exceptions and reporting them objectively.

Audit scope may include:

notice and consent evidence;
data inventory and purpose mapping;
processor contracts;
security safeguards;
breach readiness;
rights-request workflows;
retention and erasure;
children’s-data controls;
cross-border processing;
DPIA governance;
algorithmic-risk controls;
grievance handling;
training and access governance; and
evidence placed before the board.

Rule 13: annual DPIA and audit cycle

Rule 13 adds a clear recurring timetable. Once an entity is notified as an SDF, or included in a notified class, it must undertake a Data Protection Impact Assessment and an audit once in every period of twelve months from the date of notification or inclusion.

This converts the SDF programme into an annual assurance cycle rather than a one-time compliance project.

The final Rules further require the person carrying out the DPIA and audit to furnish to the Data Protection Board a report containing significant observations from those exercises.

What is a Data Protection Impact Assessment?

A DPIA is a structured evaluation of privacy risk before or during significant processing activity. Section 10 describes the process as including:

a description of the rights of Data Principals;
the purpose of processing their personal data;
assessment of risks to Data Principal rights;
management of those risks; and
other matters prescribed by the Rules.

For an SDF, the DPIA should be evidence-based and connected to actual systems, products, vendors and decisions rather than a generic privacy questionnaire.

When should an organisation trigger an internal DPIA?

Even before legal SDF designation, an organisation should consider a DPIA where it plans or materially changes processing involving:

large-scale profiling;
automated eligibility or scoring;
high-volume sensitive personal data;
children’s personal data;
biometric or identity systems;
location tracking;
employee surveillance;
new AI or algorithmic models using personal data;
new cross-border processing architecture;
data combinations capable of producing detailed behavioural profiles; or
a product whose failure could materially affect individual rights at scale.

A practical DPIA structure

Describe the processing: purpose, data categories, individuals, systems, processors, recipients and locations.
Identify the statutory basis: consent or permitted legitimate use.
Test necessity: whether each category of data is needed for the stated purpose.
Map rights impact: access, correction, erasure, grievance, discrimination, exclusion or other foreseeable effects.
Assess security risk: confidentiality, integrity, availability, access and breach consequences.
Assess algorithmic risk: bias, opacity, incorrect outputs, exclusion and adverse user effects.
Review processors: contracts, subprocessors, hosting, breach escalation and deletion capability.
Review cross-border flows: foreign hosting, remote access and Government restrictions.
Identify mitigations: redesign, minimisation, access control, human review, testing, retention limits or contractual change.
Record residual risk: identify risk accepted by management and reasons.
Approve and monitor: obtain accountable business and DPO approval and set review triggers.

Rule 13(3): algorithmic software and technical-measure due diligence

One of the most important features of the final Rules is the express requirement that an SDF exercise due diligence to verify that technical measures, including algorithmic software, used in processing are not likely to pose a risk to the rights of Data Principals.

The wording is broad. It covers technical measures used for activities such as hosting, display, uploading, modification, publishing, transmission, storage, updating and sharing of personal data.

This means SDF compliance will not stop at privacy notices and cybersecurity. Organisations using automated systems must also examine how those systems affect individual rights.

What should an algorithmic-risk review examine?

what personal data enters the model or automated system;
purpose for which the system is used;
whether data used for training or inference is accurate and appropriate;
whether outputs can materially affect a Data Principal;
bias or disparate impact;
false-positive and false-negative rates;
availability of meaningful human review;
explainability appropriate to the use case;
security of model inputs and outputs;
vendor model governance;
retention of prompts, logs or behavioural profiles;
testing before deployment and after significant model change; and
documented remediation of known risks.

A company should not assume that outsourcing AI to a vendor transfers responsibility for the rights impact of the processing.

Rule 13(4): possible India localisation of specified personal data

The final Rules create a targeted localisation mechanism for SDFs. Rule 13 provides that an SDF must take measures to ensure that personal data specified by the Central Government, based on recommendations of a committee, is processed subject to a restriction that the personal data and the traffic data pertaining to its flow are not transferred outside India.

This is not the same as saying that every category of personal data processed by every SDF must already be stored only in India.

The correct approach is:

identify any Government specification of data subject to Rule 13 restrictions;
map primary, backup and disaster-recovery locations;
map foreign cloud regions and subprocessors;
identify remote foreign administrator access;
identify telemetry and traffic-data flows;
test vendor ability to enforce geography restrictions; and
preserve technical evidence showing compliance.

Cross-border processing for SDFs: two separate questions

SDFs must consider both the general cross-border framework and the special Rule 13 localisation mechanism.

Issue	Legal focus
General transfer outside India	Section 16 and Rule 15 restrictions / Government requirements
Specified SDF personal data	Rule 13 restriction against transfer outside India where Government specifies the data
Sectoral localisation	Banking, payments, telecom, insurance, defence or other sector-specific rules
Contractual restrictions	Customer, Government, enterprise or security-contract obligations

An organisation may therefore have to comply with multiple localisation layers simultaneously.

Board accountability is built into the SDF regime

Section 10 requires the DPO to be responsible to the board or similar governing body. This is a strong statutory signal that SDF compliance is a governance matter, not simply an IT function.

A board-level SDF dashboard should ordinarily address:

current SDF designation status and notifications monitored;
DPO appointment and independence;
annual DPIA and audit status;
significant findings reported or proposed to be reported to the Board;
high-risk processing inventory;
algorithmic systems affecting Data Principals;
major processors and vendor risk;
cross-border and localisation exposure;
material personal data breaches;
rights and grievance metrics;
overdue remediation items;
accepted residual risks; and
budget and resource sufficiency.

Independent audit versus internal audit

An internal audit team can still play an important role in control testing and pre-assurance work. But Section 10 expressly requires appointment of an independent data auditor.

An SDF should therefore build a three-layer assurance model:

First line: product, operations, HR, marketing and technology teams own controls.
Second line: DPO, privacy, legal, information-security governance and compliance functions monitor and challenge.
Third / independent assurance: independent data auditor evaluates compliance and significant observations.

Processor contracts become more important for SDFs

An SDF remains accountable for processing carried out on its behalf. Its vendor contracts must therefore support the level of evidence needed for DPIA and audit.

Processor agreements should address:

precise processing purpose and instructions;
security baseline;
breach escalation significantly shorter than statutory reporting deadlines;
rights-request support;
retention and verified deletion;
subprocessor approval and transparency;
cross-border hosting and remote access;
audit rights and evidence access;
algorithmic systems used by the processor;
cooperation with DPIAs and independent audits;
preservation of logs and evidence; and
exit-transition and deletion certification.

For detailed contracting issues, see Data Processing Agreements Under the DPDP Act: Mandatory Clauses, Processor Liability, Security, Breaches and Cross-Border Data.

SDF readiness and Data Principal rights

SDF controls must ultimately support the statutory rights of individuals. A sophisticated privacy programme that cannot locate, correct, erase or explain personal data is operationally incomplete.

Readiness should therefore integrate:

identity verification;
data discovery across enterprise systems;
processor search and deletion capability;
retention-exception logic;
grievance escalation;
nomination mechanisms; and
audit trails showing how each request was handled.

See Data Principal Rights Under the DPDP Act: Access, Correction, Erasure, Grievance, Nomination & 2027 Commencement.

SDF readiness and personal data breaches

Because SDFs are likely to be entities with larger or higher-risk processing operations, breach governance should be designed as a board-level incident process.

The organisation should establish:

continuous detection and logging;
clear incident-severity criteria;
legal privilege where appropriate;
processor escalation deadlines;
rapid affected-data identification;
Data Principal notification templates;
Data Protection Board reporting workflow;
CERT-In and sector-regulator coordination;
evidence preservation;
root-cause analysis; and
post-incident remediation tracked to closure.

For the breach framework, see Personal Data Breach Reporting in India: DPDP 72-Hour Rule, CERT-In 6-Hour Rule, Notices, Evidence and Penalties.

Potential penalty exposure

The Schedule to the DPDP Act provides a specific maximum monetary penalty for breach of the additional obligations of a Significant Data Fiduciary under Section 10. The scheduled maximum is ₹150 crore.

This is separate from other possible DPDP penalties, including the higher maximum for breach of reasonable security safeguards and the separate maximum for breach-notification failures.

Penalty analysis should not therefore be reduced to “₹150 crore for everything.” One incident may implicate several distinct statutory obligations depending on the facts.

SDF readiness checklist for 2026–27

Track MeitY and Gazette notifications for SDF designation.
Prepare an internal Section 10 risk profile using the statutory designation factors.
Map high-volume and high-sensitivity processing activities.
Identify processing affecting electoral, public-order, national-security or systemic interests.
Nominate a senior privacy leader and design the statutory DPO reporting structure.
Prepare a board-approved DPO charter.
Define independence criteria for the external data auditor.
Build a repeatable annual DPIA methodology.
Create a DPIA register and trigger matrix.
Inventory every algorithmic system that uses personal data.
Document model purpose, data inputs, outputs and rights impact.
Map all cross-border data and traffic-data flows.
Test the ability to localise specified datasets if Government directions require it.
Update processor and cloud contracts for audit, DPIA and localisation support.
Build board-level privacy and cyber reporting.
Run a mock independent audit before May 2027.
Test rights-request and grievance workflows.
Run breach tabletop exercises involving the board, DPO, security, legal and communications teams.
Preserve documentary evidence of remediation.
Set a formal pre-commencement legal review before 13 May 2027.

What should a pre-SDF readiness report contain?

Area	Evidence to prepare	Typical risk
Designation exposure	Section 10 factor assessment	No view of whether business is likely to be notified
DPO	Charter, reporting line, role description	DPO lacks authority or independence
DPIA	Methodology, register, completed assessments	High-risk processing launched without structured review
Audit	Scope, evidence index, remediation tracker	Policies exist but controls cannot be demonstrated
Algorithms	Inventory, testing, rights-impact assessment	Automated systems create unmeasured user risk
Localisation	Hosting map, traffic-data flow map	Cannot comply quickly with a Government restriction
Processors	DPA, subprocessor list, audit evidence	Vendor blocks rights, audit or deletion obligations
Board oversight	Minutes, dashboards, risk acceptance	Privacy treated only as operational IT issue

Common mistakes in SDF preparation

assuming SDF status depends on a threshold that the Act does not prescribe;
waiting for formal notification before designing governance;
appointing a nominal DPO with no board access;
using the same team to design, operate and independently audit every control;
treating a DPIA as a one-page legal sign-off;
ignoring AI and algorithmic processing;
assuming all cross-border data is automatically prohibited;
assuming no localisation obligation can arise until a separate Act is passed;
failing to map traffic data and remote-access pathways;
using processor contracts that provide no audit evidence;
failing to distinguish current 2026 legal status from the 13 May 2027 commencement; and
reporting “compliant” to the board without evidence of operating effectiveness.

Frequently asked questions

What is a Significant Data Fiduciary?

It is a Data Fiduciary or class of Data Fiduciaries notified by the Central Government under Section 10 DPDP Act based on statutory risk factors including scale, sensitivity and public-interest considerations.

Is there a fixed user or turnover threshold for becoming an SDF?

No fixed threshold appears in Section 10. The statute uses a Government-notification model based on multiple relevant factors.

Is every large company automatically an SDF?

No. A large company may be a likely candidate for assessment, but legal SDF status depends on the Central Government notification.

Must an SDF appoint a DPO in India?

Yes. Section 10 requires the DPO to be based in India and responsible to the board of directors or similar governing body.

Is an independent data auditor mandatory?

Yes, once the SDF obligation applies. Section 10 expressly requires appointment of an independent data auditor.

How often must an SDF conduct a DPIA?

Rule 13 requires a DPIA and audit once in every twelve-month period from the date on which the entity is notified as an SDF or included in a notified class.

Does the DPIA report go to the Data Protection Board?

Rule 13 requires the person carrying out the DPIA and audit to furnish the Board a report containing significant observations from those exercises.

Does Rule 13 regulate AI and algorithms?

Yes. It requires due diligence to verify that technical measures, including algorithmic software used in processing, are not likely to pose risks to Data Principal rights.

Must all SDF data stay in India?

No blanket rule in Rule 13 says that all SDF data must always remain in India. The Rule creates a mechanism for the Central Government to specify personal data subject to a restriction preventing transfer of that data and related traffic data outside India.

When do Section 10 and Rule 13 become operative?

They are part of the main eighteen-month commencement phase scheduled for 13 May 2027, subject to any later statutory notification changing the timeline.

What is the maximum penalty for breach of SDF-specific obligations?

The Schedule provides a maximum of ₹150 crore for breach of the additional obligations of Significant Data Fiduciaries under Section 10.

Primary legal sources

Conclusion

The Significant Data Fiduciary regime is designed for organisations whose processing creates enhanced individual, systemic or public-interest risk. It adds governance duties that ordinary privacy programmes may not yet have: a statutory India-based DPO reporting to the board, an independent data auditor, annual DPIAs and audits, Board-facing significant observations, algorithmic due diligence and the ability to comply with targeted data-localisation restrictions.

The immediate 2026 issue is not to pretend those obligations are already fully operative. It is to use the implementation window correctly. Organisations with high-volume, sensitive or systemically important processing should build the SDF operating model now so that a future designation or the 13 May 2027 commencement does not trigger a rushed governance exercise.

This article is for general legal education and compliance information only. It does not constitute solicitation or case-specific legal advice. SDF status depends on Government notifications, the applicable commencement provisions, subsequent MeitY directions, sector-specific laws and the actual processing architecture of the organisation.

Fastrack Legal Solutions