Rule 13
Additional obligations of Significant Data Fiduciary
Sets the twelve-month DPIA and audit cycle, the report to the Board, algorithmic due diligence, and a hard localisation restriction.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- A Significant Data Fiduciary must, once every twelve months from being notified as such, undertake a Data Protection Impact Assessment and an audit.
- (2)
- It must cause the person carrying out the assessment and audit to furnish a report of significant observations to the Board.
- (3)
- It must observe due diligence to verify that its technical measures, including algorithmic software used for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing, are not likely to pose a risk to the rights of Data Principals.
- (4)
- It must ensure that personal data specified by the Central Government, and the traffic data pertaining to its flow, is not transferred outside India.
- (5)
- Defines committee for the purposes of this rule.
In practice
The clock in sub-rule (1) runs from the date of notification, not from a financial year, so the deadline is company-specific. Sub-rule (4) is the sharper one: it is an outright localisation bar for specified categories, and unlike s.16 it does not depend on which country the data is going to.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 13 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.