Significant Data Fiduciary obligations: DPO, DPIA, audit
Reviewed against the law as of 28 September 2026
Significant Data Fiduciary duties under the DPDP Act: a DPO in India, an independent auditor, annual DPIA and audit, and algorithmic due diligence.
Section 10 of the DPDP Act lets the Central Government notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary (SDF). SDFs carry every ordinary obligation plus additional ones, and breaching them can attract a penalty of up to ₹150 crore.
What the government considers
The Act lists factors the government may assess, including:
- the volume and sensitivity of personal data processed;
- the risk to the rights of Data Principals;
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- security of the State and public order.
Large banks, insurers, telecom operators, health platforms, e-commerce and social media companies are the likeliest candidates.
The additional obligations
| Obligation | What it means |
|---|---|
| Data Protection Officer | A DPO based in India, responsible to the board of directors or equivalent body, and the point of contact for grievance redressal |
| Independent data auditor | An auditor to evaluate the SDF's compliance with the Act |
| Data Protection Impact Assessment | Periodic DPIAs describing the rights of Data Principals, the purpose of processing, the assessment and management of risks |
| Periodic audit | Audits, with other measures the government may prescribe |
The DPDP Rules add detail:
- a DPIA and an audit once in every twelve months, with a report of significant observations furnished to the Data Protection Board;
- due diligence on algorithmic software used for processing personal data, to verify it is not likely to pose a risk to Data Principals' rights;
- measures to ensure specified personal data, as identified by a government committee, is processed subject to the restriction that it and related traffic data are not transferred outside India.
Building an SDF programme
- Governance. Appoint the DPO early, with a reporting line to the board and the authority to act.
- Inventory and records of processing. A DPIA is only as good as your knowledge of what is processed, where and why.
- Risk-based DPIAs. Start with the highest-risk processing: large volumes, sensitive identifiers, children, profiling, AI.
- Algorithmic systems. Inventory the AI and algorithmic systems that touch personal data, their purposes, oversight and testing.
- Continuous evidence. An annual audit is easier when evidence is collected all year round.
- Localisation readiness. Know where data and its traffic data flow, so that you can act if a restriction is notified.
TrustNiq supports SDF duties with DPIA tracking, an AI system inventory with shadow AI detection, cross-border flow mapping, and audit packages built from continuously collected evidence. Talk to us about Enterprise.
Frequently asked questions
How do we know if we are a Significant Data Fiduciary?
The Central Government notifies Significant Data Fiduciaries, individually or as a class. Until notified, you are not one, but large processors of sensitive data should prepare.
How often must a Significant Data Fiduciary do a DPIA and audit?
The Rules require a Data Protection Impact Assessment and an audit once in every twelve months, with a report of significant observations furnished to the Board.
What is the penalty for breaching SDF obligations?
Up to ₹150 crore under the Schedule to the Act.
Sources
- Digital Personal Data Protection Act, 2023, section 10meity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.