Section 10: The SDF Designation Power
Section 10 of the DPDPA empowers the Central Government to notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary (SDF). The designation is based on an assessment of: (a) the volume and sensitivity of personal data processed, (b) risk to the rights of Data Principals, (c) potential impact on the sovereignty and integrity of India, (d) risk to electoral democracy, (e) security of the State, and (f) public order.
When MNC Subsidiaries Cross the Threshold
India subsidiaries of multinational companies can cross the SDF threshold in several ways. The most common: (a) the subsidiary processes personal data of a large number of Indian Data Principals (the volume trigger), (b) the subsidiary processes sensitive categories of data such as health data, financial data, or biometric data at scale, (c) the subsidiary is in a sector that the government considers strategically sensitive (telecom, defence, critical infrastructure), or (d) the subsidiary's data processing poses potential risks to national security or public order.
Enhanced Obligations of an SDF
Once designated, an SDF must, under Section 10 of the Act read with Rule 13 of the DPDP Rules, 2025: (a) appoint a Data Protection Officer (DPO) based in India who represents the SDF and is answerable to the Board (Section 10(2)(a)); (b) appoint an independent data auditor to carry out a data audit (Section 10(2)(b)); (c) undertake, at a periodicity prescribed under Rule 13, a Data Protection Impact Assessment and a data audit; and (d) observe due diligence to verify that technical measures, including algorithmic software deployed for processing personal data, are not likely to pose a risk to the rights of Data Principals (Rule 13(3)).
The DPO Requirement
The DPO appointed by an SDF must be based in India and must be senior management. This creates a practical problem for lean subsidiary operations — a dedicated, India-based, senior DPO is a significant resource commitment. The DPO reports directly to the Board of Directors of the SDF entity and acts as the point of contact for the Data Protection Board of India. The DPO cannot be a shared resource based outside India, even if the global parent has a Group DPO in another jurisdiction.
Audit Obligations
Rule 13 prescribes the audit framework. The independent data auditor must evaluate: the completeness and accuracy of the description of processing, the appropriateness of automated processing and associated safeguards, the data security measures, and the effectiveness of measures to prevent data breaches. The audit report is submitted to the Board. Non-compliance identified in the audit must be remediated on a prescribed timeline.
Impact Assessment Obligations
Rule 13 mandates periodic DPIAs. For technology companies, this is particularly significant because the assessment must cover: (a) the rights of Data Principals, (b) the purpose and means of processing, (c) the categories and volume of personal data processed, (d) the risk of harm to Data Principals, and (e) the measures to manage and mitigate risk. Algorithmic processing — including AI and ML systems — must be specifically assessed.
How to Prepare Before Designation
Waiting for the SDF notification before beginning preparation is a strategic mistake. Companies that anticipate SDF designation should: (a) begin DPO recruitment immediately, (b) commission a baseline DPIA to identify gaps, (c) engage independent data auditors and establish the audit relationship, (d) implement board-level data protection governance, and (e) budget for the enhanced compliance infrastructure. The notification will set a compliance deadline — companies that have not prepared will face an impossible implementation timeline.