s.10 · Rule 13 · s.2
Significant Data Fiduciary
A Significant Data Fiduciary is a Data Fiduciary, or a class of them, that the Central Government notifies as significant because of the volume and sensitivity of the data it handles and the risk it poses.
The designation adds obligations on top of the ordinary ones: appointing a Data Protection Officer based in India, appointing an independent data auditor, and carrying out a Data Protection Impact Assessment and an audit every twelve months, with a report to the Board.
Rule 13 adds algorithmic due diligence and a restriction on transferring specified personal data outside India. No class had been notified as of September 2026; the designation is a power the Government holds, not a threshold a business can compute for itself.
Questions people ask
- How do I know if we are a Significant Data Fiduciary?
- Only by notification. The Government notifies fiduciaries or classes of them under Section 10(1); until then no business is one.
- Does every business need a Data Protection Officer?
- No. Section 10 requires a DPO only of a Significant Data Fiduciary. Every Data Fiduciary must publish the contact of a person who can answer questions about processing, under Section 8(9), which is a different and lighter duty.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.