Prepare for the letterbefore it arrives.

SDF status is notified, not chosen. The obligations take longer to build than the notice takes to read.

In one line: Beyond Section 10's DPO, independent auditor, DPIA and audit requirements, the Rules require an annual DPIA and audit and due diligence that algorithmic software does not pose risks to Data Principals' rights, among other measures.

The estate · TelecomHover to inspect

Significant Data Fiduciary is not a title. It is a timetable.

The scene

The board asked a simple question: if we were notified tomorrow, what would change? Management listed four things: a DPO in India answerable to the board, an independent auditor, an annual impact assessment and audit, and a review of algorithmic systems. Nobody could say how long each would take.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
We'll build it once notified. The obligations require people, audits and assessments that cannot be stood up overnight. Build the SDF stack in advance.
The CISO can be the DPO. The DPO must represent the fiduciary and answer to the board on data protection, a broader role. Design the DPO role for independence and authority.

Algorithmic due diligence

The Rules require SDFs to verify that algorithmic software used for processing personal data does not pose a risk to Data Principals' rights. Start with fraud, credit and churn models.

Monday morning

  1. 01Write the SDF gap list: DPO, auditor, DPIA, audit, algorithms.
  2. 02Estimate lead time for each.
  3. 03Take the list to the board.

Questions, answered plainly

What must a Significant Data Fiduciary do under the DPDP Rules?

Beyond Section 10's DPO, independent auditor, DPIA and audit requirements, the Rules require an annual DPIA and audit and due diligence that algorithmic software does not pose risks to Data Principals' rights, among other measures.

What is the penalty for breaching SDF obligations?

Breach of the additional obligations of a Significant Data Fiduciary can attract a penalty of up to ₹150 crore.

Sector · TelecomA billion subscribers. A billion Data Principals.Read → Telecom · Deep diveThe network's weakest node is a retailer's phone.Read → Telecom · Deep diveA tenth of a percent is a hundred thousand requests.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner