The Significant Data Fiduciary is the only tier in India's Digital Personal Data Protection Act that carries materially heavier duties — an annual impact assessment, an independent audit, algorithmic due diligence and a localisation obligation. It is also the only role you cannot assign yourself. The Central Government notifies it, and until it does, rule 13 does not bind you.
That combination produces a planning problem. You cannot register, apply or opt in, so you cannot know with certainty whether the duties will land on you. What you can do is read the factors the Act directs the government to weigh and judge how exposed you look against them.
What Is a Significant Data Fiduciary?
A Significant Data Fiduciary is a Data Fiduciary, or a class of them, that the Central Government notifies as significant under section 10 of the Act. The notification is the operative event. Before it, you hold the ordinary fiduciary duties; after it, rule 13's four additional duties attach on top, along with the appointment obligations in section 10(2).
There is no public threshold to clear, no self-certification and no registry to join. The Seventh Schedule to the Rules designates a Ministry of Electronics and Information Technology officer to carry out the assessment supporting that notification.
You Do Not Self-Assess Into the Category
This is the distinction that matters most in planning, and it runs opposite to the instinct most compliance teams have.
Under GDPR you assess your own processing and conclude, for instance, that a DPIA is required. Under DPDP the heavier tier is conferred, not derived. A large platform processing enormous volumes of sensitive personal data holds only the ordinary fiduciary duties until the government says otherwise. A smaller entity in a sector the government considers systemically sensitive could be notified as a class.
The practical consequence is that rule 13 is a contingency to design for rather than a duty to discharge. Building the DPIA and audit machinery before notification is defensible preparation; asserting you are a Significant Data Fiduciary when you have not been notified is not a compliance position, it is a misreading.
Want to know how exposed you look against the section 10 factors?
Share your work email and we'll walk your processing volumes and data categories against the factors the Act directs the government to weigh, and what rule 13 would add.
The Factors the Government Weighs
Section 10 directs the Central Government to have regard to a set of factors when notifying a fiduciary or a class as significant:
- The volume and sensitivity of personal data processed
- The risk to the rights of Data Principals
- The potential impact on the sovereignty and integrity of India
- The risk to electoral democracy
- The security of the State
- Public order
Read the list as a whole and the shape of the category becomes clearer. Three of the six factors are not about scale at all — they are about systemic and political consequence. An entity processing modest volumes could still be notified if its data touches electoral processes or state security, while a large-volume processor of low-sensitivity commercial data may never be.
The Extra Duties Once You Are Notified
Two layers attach. Section 10(2) of the Act requires a notified Significant Data Fiduciary to appoint a Data Protection Officer who is based in India, represents the entity, is responsible to its Board of Directors or equivalent governing body, and is the point of contact for grievance redressal — and to appoint an independent data auditor to evaluate compliance.
Rule 13 then adds four duties:
| Duty | What it requires |
|---|---|
| Periodic DPIA and audit | A Data Protection Impact Assessment and an audit once every twelve months |
| Reporting to the Board | Furnishing a report of significant observations from both to the Data Protection Board |
| Algorithmic due diligence | Verifying that algorithmic software used for hosting, display, upload, modification, publication, transmission, storage, updating or sharing of personal data is not likely to pose a risk to Data Principals' rights |
| Localisation | Ensuring that personal data the Central Government specifies, on a committee's recommendation, together with its traffic data, is not transferred outside India |
Note that the DPIA and the audit are separate exercises on the same annual cycle, not one deliverable. The DPIA is forward-looking risk analysis; the audit is independent verification that what you said you do is what you do. Only the significant observations go to the Board, not the full reports.
The algorithmic due-diligence duty is the one with the least precedent. It is phrased around software used for handling personal data rather than around automated decision-making in the GDPR or CCPA sense, so it reaches recommendation, ranking and storage systems that would not register as consequential decisions under those regimes.
The Only Localisation Duty in the Rules
Rule 13(4) is where India's data-localisation obligation actually lives, and it is narrower than most summaries suggest. It applies only to notified Significant Data Fiduciaries, and only to classes of personal data the Central Government specifies on a committee's recommendation.
The general transfer rule is permissive. Rule 15 permits transfer of personal data outside India, subject to any requirements the Central Government specifies by general or special order about making that data available to a foreign State or to a person or entity under its control. There is no blanket localisation duty under DPDP.
Sector rules are a separate matter and frequently stricter. RBI's "Storage of Payment System Data" circular of 6 April 2018 imposes a genuine localisation duty on payment system data that rule 15 does not, and where the two differ the stricter one governs. Our DPDP compliance checklist covers the sector overlays alongside the baseline duties.
How to Prepare Without Being Notified Yet
Treat rule 13 as a design constraint rather than a programme. Most of the preparation is work you would want anyway.
- Build the DPIA capability, not the DPIA. A repeatable assessment method you can run on a new processing activity is useful immediately and becomes the annual deliverable if you are notified.
- Keep your evidence auditable by someone external. The audit requires an independent data auditor. Evidence that only your own team can interpret will not survive one.
- Inventory your algorithmic surface. List the software that hosts, displays, uploads, modifies, publishes, transmits, stores, updates or shares personal data. This is the hardest item to assemble retrospectively.
- Know which data classes you could not localise. If rule 13(4) landed tomorrow, which flows would break? That answer is worth having before the committee publishes anything.
- Watch for class notifications, not just entity ones. Section 10 permits notifying a class of fiduciaries, so a sector-wide notification could capture you without any assessment of your specific entity.
- Do not claim the status early. Appointing a DPO and running audits is good practice; describing yourself as a Significant Data Fiduciary in customer paperwork when you have not been notified misstates your regulatory position.
Significant Data Fiduciary Questions Teams Ask
Notification comes from the Central Government under section 10, and the Seventh Schedule to the Rules designates a MeitY officer to carry out the assessment supporting it. It is a government act rather than a self-assessment, so the practical answer is to monitor MeitY and Data Protection Board publications for both entity-specific and class-wide notifications. Until you are notified, rule 13 does not bind you.
No. Section 10 lists factors the government weighs — volume and sensitivity of personal data, risk to Data Principals' rights, potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State, and public order — but sets no numeric threshold. Three of those six factors concern systemic consequence rather than scale, so a modest-volume processor in a sensitive domain can be more exposed than a large commercial one. The user-count thresholds in the Third Schedule relate to retention duties, not to this category.
Rule 13(1) requires a Data Protection Impact Assessment and an audit once every twelve months, which is a periodic obligation on the fiduciary rather than a per-activity trigger of the GDPR kind. In practice a credible annual DPIA has to cover the processing activities that carry material risk, so the scoping question becomes which activities the assessment must reach. Building a repeatable per-activity method is the usual way teams satisfy the annual duty without a scramble.
Not if you are a notified Significant Data Fiduciary. Section 10(2) requires the DPO to be based in India, to represent the entity, to be responsible to its board or equivalent governing body, and to be the point of contact for grievance redressal. An ordinary Data Fiduciary has no DPO appointment duty at all — rule 9 requires only that you prominently publish the business contact details of the DPO if applicable, or of a person who can answer questions about processing.
No. Rule 13(4) requires a notified SDF to ensure that personal data the Central Government specifies, on a committee's recommendation, together with its traffic data, is not transferred outside India. It is class-specific rather than blanket, and it depends on the government specifying the classes. The general rule in rule 15 permits transfer outside India subject to requirements the government may specify. Sector instruments can be stricter, and RBI's payment-data circular is.
Build the DPIA and audit machinery before you need it
Book a demo and we'll show how Konfirmity runs impact assessments and keeps the evidence an independent data auditor will ask for, whether or not you are ever notified.
Book a demo
Build the Capabilities, Skip the Label
Build the capabilities and skip the label, because Significant Data Fiduciary status is conferred rather than claimed. That makes it unusual among compliance obligations and easy to mishandle in both directions — teams either ignore rule 13 entirely because it does not bind them yet, or assert the status to look diligent and misstate their regulatory position.
The useful middle is to build the capabilities and skip the label. A repeatable impact assessment, evidence an external auditor can read, and a current inventory of your algorithmic surface are worth having regardless. If a notification arrives, you are discharging duties rather than starting a programme.
