Significant Data Fiduciary (SDF) Obligations

Section 10(1) empowers the Central Government to designate certain Data Fiduciaries as Significant Data Fiduciaries based on several criteria. These include the volume and sensitivity of personal data processed, risk to Data Principal rights, potential impact on India's sovereignty and integrity, and risk to electoral democracy.

This designation creates a tiered regulatory system where entities handling substantial data volumes or sensitive categories face enhanced scrutiny.

Unlike GDPR's automatic threshold based categorisation, DPDPA uses a notification based approach. This means organisations cannot definitively assess their SDF status until formal designation happens. Large data processors need to anticipate potential designation and build compliance capabilities proactively rather than waiting for notification.

Section 10(2) imposes additional obligations on designated SDFs that significantly increase their compliance burden.

The requirement to appoint a Data Protection Officer based in India has human resource implications for multinationals that typically centralise privacy functions globally. DPOs must have appropriate qualifications and operate independently. They cannot be penalised for doing their job and must report directly to the board or highest management level.

Periodic Data Protection Impact Assessments become mandatory rather than optional. These require systematic evaluation of processing operations against privacy risks. Perhaps most significantly, SDFs must engage independent auditors to verify compliance annually, with audit reports submitted to the Data Protection Board. This external verification transforms compliance from internal attestation to externally validated accountability.