Privacy is not a department.It is a board decision.

If it takes more than three seconds to name who owns DPDPA outcomes, you have a governance gap.

In one line: A Significant Data Fiduciary is a Data Fiduciary or class notified by the Central Government under Section 10, considering factors such as volume and sensitivity of data, risk to Data Principals, and impact on sovereignty, security and public order.

The estate · The board questionHover to inspect

Significant Data Fiduciary is not a title. It is a target.

The scene

The board pack had a single slide on DPDPA, between treasury and CSR. It said 'on track'. Nobody asked on track to what. Nobody asked what would happen if the Government notified the company as a Significant Data Fiduciary next quarter.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
It's an operational matter. Penalties up to ₹250 crore are balance-sheet events. Treat exposure like credit risk: quantified, owned, reported.
We're not an SDF. The Government notifies SDFs based on volume, sensitivity and risk; it is not self-declared. Prepare as if you might be named.
The DPO will handle it. A DPO without authority is a scapegoat with a title. Give the role a board line, a budget and a veto.

What Significant Data Fiduciaries must do

Section 10 requires an India-based Data Protection Officer answerable to the board, an independent data auditor, periodic data protection impact assessments and audits, and other measures the Rules prescribe. The Rules add an annual cycle and scrutiny of algorithmic software.

Monday morning

  1. 01Put DPDPA exposure on the risk register with a number, not a colour.
  2. 02Ask management: if we were notified as an SDF tomorrow, what would change?
  3. 03Schedule one board session on the worst-week scenario.

Questions, answered plainly

What is a Significant Data Fiduciary under DPDPA?

A Significant Data Fiduciary is a Data Fiduciary or class notified by the Central Government under Section 10, considering factors such as volume and sensitivity of data, risk to Data Principals, and impact on sovereignty, security and public order.

What are the obligations of a Significant Data Fiduciary?

It must appoint a Data Protection Officer based in India who is responsible to the board, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits, along with measures in the Rules.

Argument 08₹250 crore is not a line item. It is a balance-sheet event.Read → Argument 01Implementation ends on a date. Resilience begins on it.Read → Argument 02Before data leaks, clarity leaks.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner