Significant Data Fiduciary: Are You One and Don't Know It?
Definitive Checklist for SDF Classification Under DPDPA 2023
Type
Article
Sections
5 Parts
References
7 Provisions
Takeaways
5 Key Points
Executive Brief
Significant Data Fiduciary: Are You One and Don't Know It?
The criteria for Significant Data Fiduciary classification under DPDPA are broader than most assume. This definitive checklist helps you determine your precise obligations and risk exposure.
Part 1 of 5
What is a Significant Data Fiduciary?
Under Section 10 of the DPDPA 2023, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary (SDF) based on several assessment factors. Rule 13 of the DPDP Rules 2025 further elaborates the criteria and additional obligations for SDFs.
The factors the Central Government considers include: the volume and sensitivity of personal data processed; the risk of harm to Data Principals; the potential impact on the sovereignty and integrity of India, public order, and security of the State; and the use of new technologies for processing. While the exact numerical thresholds are being operationalised, indicative criteria based on industry practice and regulatory guidance suggest entities processing personal data of 50 lakh (5 million) or more Indian residents, or having annual revenue of ₹250 Crore or more, are at heightened risk of SDF classification.
The consequences of operating as an SDF without fulfilling SDF obligations are severe: penalties under Section 10 non-compliance can reach ₹150 Crore under The Schedule of the Act.
Part 2 of 5
Key Factors for SDF Classification
The Central Government assesses multiple factors when determining SDF status. These are not rigid numerical thresholds but qualitative and quantitative criteria that, when met individually or in combination, trigger classification:
Factor 1 — Volume of Personal Data Processed: Organisations processing personal data of a large number of Data Principals in India. Indicative thresholds suggest 50 lakh (5 million) or more individuals. This includes all categories: customers, employees, contractors, vendors, website visitors (if identifiable), referrals, and dependents.
Factor 2 — Sensitivity of Data: Processing of sensitive categories — financial data, health data, biometric data, genetic data, caste, religious or political beliefs, trade union membership, or sexual orientation data — at scale increases SDF risk regardless of volume.
Factor 3 — Risk of Harm to Data Principals: Automated decision-making that produces legal or similarly significant effects — credit scoring, hiring algorithms, insurance pricing, treatment recommendations — creates heightened SDF risk because processing errors directly harm individuals.
Factor 4 — Impact on Sovereignty, Public Order, and Security: Data Fiduciaries whose processing activities could affect national interests, critical information infrastructure, or public order. Organisations designated as Key Information Infrastructure (KII) operators under the Information Technology Act, 2000 are automatically at heightened SDF risk.
Factor 5 — Use of New Technologies: Adoption of advanced technologies for data processing — including AI/ML-based profiling, large-scale behavioural analytics, and cross-source data combination — contributes to SDF assessment.
Part 3 of 5
Cross-Border Transfers and SDF Risk
Cross-border data transfers add a significant dimension to SDF assessment. Organisations that transfer personal data of Indian Data Principals to entities or jurisdictions outside India — whether through cloud infrastructure (AWS, Google Cloud, Azure), SaaS platforms (Salesforce, HubSpot, etc.), global parent companies, or third-party service providers — face heightened scrutiny.
Section 16 of the DPDPA governs cross-border transfers and requires transfers to be made through prescribed mechanisms. The intersection of cross-border transfer activity with large-scale processing increases the likelihood of SDF classification.
Practical implication: A majority of SaaS companies, fintech platforms, and e-commerce firms in India transfer data offshore through cloud infrastructure without recognising that this contributes to their SDF risk profile. Cloud hosting in foreign jurisdictions — even for processing purposes — constitutes a cross-border transfer.
Part 4 of 5
Obligations Once Classified as SDF
Once an entity is notified as an SDF under Section 10, it must comply with enhanced obligations beyond those applicable to general Data Fiduciaries:
Obligation 1 — Appoint a Data Protection Officer (DPO): The DPO must be based in India, serve as the point of contact for the DPBI, oversee compliance, conduct impact assessments, and handle Data Principal grievances. The DPO must have direct reporting access to the board of directors.
Obligation 2 — Appoint an Independent Data Auditor: The auditor evaluates the SDF's compliance with DPDPA provisions and certifies compliance status to the Board.
Obligation 3 — Conduct Data Protection Impact Assessments (DPIAs): SDFs must conduct DPIAs for high-risk processing activities, including those involving sensitive data, large-scale profiling, or decision-making systems affecting Data Principals.
Obligation 4 — Periodic Audits: Annual compliance reviews assessing adherence to DPDPA principles, implementation of protection measures, and fulfilment of Data Principal rights.
Obligation 5 — Enhanced Record-Keeping: Detailed records including a Data Processing Register, consent records, incident logs, DPIA reports, audit reports, and records of Data Principal requests — maintained for at least 7 years.
Non-compliance with these obligations attracts penalties up to ₹150 Crore under The Schedule.
Part 5 of 5
SDF Risk Assessment Checklist
Use this assessment to evaluate your organisation's SDF risk profile. Affirmative answers to any of the following indicators suggest your organisation may be classified as an SDF:
Do you process personal data of 50 lakh (5 million) or more individuals in India across all systems?
Does your annual revenue exceed ₹250 Crore?
Do you process sensitive personal data (financial, health, biometric, genetic, religious, political, union membership) at scale?
Do you perform automated profiling (credit scoring, hiring decisions, treatment recommendations, insurance pricing) that produces legal or similarly significant effects?
Do you transfer personal data of Indian Data Principals outside India — including through cloud hosting, SaaS platforms, or offshore service providers?
Are you designated as a Key Information Infrastructure operator under the IT Act, 2000?
Do you combine personal data from multiple sources to create detailed profiles or behavioural predictions affecting large populations?
Do you operate in multiple sectors with diverse data categories?
If you answered YES to one or more indicators: Your organisation has a material SDF risk profile and should conduct a formal SDF classification assessment with legal counsel. Proactive classification and compliance is significantly more defensible than reactive classification following a regulatory inquiry.
Key Takeaways
SDF classification under Section 10 is determined by the Central Government based on multiple qualitative and quantitative factors — not a single bright-line test
Key factors include volume of data processed (indicatively 50 lakh+ Data Principals), sensitivity of data categories, risk of harm, and use of new technologies
Cross-border data transfers — including cloud hosting offshore — contribute to SDF risk profile and increase classification likelihood
Once classified, SDFs must appoint a DPO, conduct DPIAs, undergo annual audits, and maintain enhanced records for 7+ years
Non-compliance with SDF obligations under Section 10 attracts penalties up to ₹150 Crore under The Schedule — independent of other violation penalties
Statutory References
Section 10: Obligations of Significant Data Fiduciaries
Rule 13 DPDP Rules 2025: SDF Criteria and Additional Obligations
Section 33 read with The Schedule: Penalty for SDF Non-Compliance — up to ₹150 Crore
Section 8(5): Reasonable Security Safeguards
Section 16: Cross-Border Transfer of Personal Data
Section 9: Additional Obligations for Children's Data
Information Technology Act, 2000: Key Information Infrastructure Designation
Significant Data Fiduciary Are You One: questions and answers
Is a Data Protection Officer mandatory under DPDPA?
A Data Protection Officer based in India is mandatory for Significant Data Fiduciaries under Section 10(2). Other Data Fiduciaries must publish the business contact information of a DPO, if applicable, or of a person able to answer questions about processing (Section 8(9) read with Rule 9).
What is a Significant Data Fiduciary and what extra duties apply?
The Central Government may notify a Data Fiduciary or class as a Significant Data Fiduciary under Section 10, considering volume and sensitivity of data, risk to Data Principals and wider public-interest factors. SDFs must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic Data Protection Impact Assessments; Rule 13 adds annual DPIA and audit and algorithmic due diligence.
What rights do individuals have under DPDPA?
Data Principals have the right to access information about processing (Section 11), correction, completion, updating and erasure (Section 12), grievance redressal (Section 13) and nomination (Section 14). Rule 14 governs the manner in which these rights are exercised.
Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to Significant Data Fiduciary Are You One?
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
Who advises businesses on Significant Data Fiduciary Are You One under India's DPDPA?
AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on Significant Data Fiduciary Are You One under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].
What should I send AMLEGALS to get a scoped proposal on Significant Data Fiduciary Are You One?
Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for Significant Data Fiduciary Are You One rather than a generic checklist.
How do I get a first view of my DPDPA exposure on Significant Data Fiduciary Are You One?
Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.
