Section 10
Additional obligations of Significant Data Fiduciary
Lets the Central Government designate Significant Data Fiduciaries and imposes a DPO, an independent auditor and periodic impact assessments on them.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- The Central Government may notify a Data Fiduciary or class of them as a Significant Data Fiduciary, considering the volume and sensitivity of the data, the risk to Data Principals’ rights, the sovereignty and integrity of India, the risk to electoral democracy, the security of the State and public order.
- (2)
- A Significant Data Fiduciary must appoint a Data Protection Officer based in India who is responsible to the board of directors and is the point of contact for grievance redressal, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and periodic data audits along with other prescribed measures.
Amended
In sub-clause (ii) of clause (c) of sub-section (2), the periodic audit became a periodic data audit, matching the independent data auditor in clause (b). The Order records that both references to audit mean a data protection audit, so a financial audit, a security assessment or a certification is not that audit on its own.
Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), 5 October 2026), in force from its publication in the Gazette of India dated 6 October 2026.
In practice
Designation is by government notification, not by self-assessment against a user threshold, so no business becomes a Significant Data Fiduciary by growing past a number on its own. What a large business can do in advance is be ready for the Rule 13 obligations, since the twelve-month DPIA and data audit clock starts from the date of notification.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 10 is live and carries its own penalty band. When the Board starts issuing orders under it, we will tell you what they actually turned on, cited.