Section 10
Significant Data Fiduciary duties in practice
What s.10 and Rule 13 ask of a Significant Data Fiduciary, what the 2026 Order changed in the wording, and how to prepare without assuming a designation.
Short answer
The Central Government can notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary under s.10 of the DPDP Act. An SDF must appoint an India-based DPO (s.10(2)(a)) and an independent data auditor (s.10(2)(b)), and carry out a periodic DPIA and data audit (s.10(2)(c)), which Rule 13 sets at once every twelve months. No SDF has been designated that we know of as of 4 November 2026.
Who can become a Significant Data Fiduciary
The Central Government notifies SDFs under s.10, based on factors such as the volume and sensitivity of personal data, the risk to Data Principals' rights, the potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order.
No SDF has been designated that we know of. Designation comes only through a notification under s.10, so being large or in a particular sector does not by itself make you one.
What section 10(2) requires
| Clause | Duty | In practice |
|---|---|---|
| s.10(2)(a) | Appoint a Data Protection Officer who represents the SDF, is based in India, is responsible to the Board of Directors or similar governing body, and is the point of contact for grievances | Name the person, record their address in India, and publish their business contact (Rule 9) |
| s.10(2)(b) | Appoint an independent data auditor | Select the auditor and record the appointment |
| s.10(2)(c) | A periodic Data Protection Impact Assessment, a periodic data audit, and other measures | Rule 13 sets the DPIA and audit at once every twelve months |
What Rule 13 adds
- A DPIA and an audit once every twelve months, with significant observations furnished to the Board.
- Due diligence that algorithmic software does not pose a risk to Data Principals' rights.
- Keeping personal data that the Central Government specifies, on a committee's recommendation, and related traffic data within India.
Rule 13 comes into force on 13 May 2027 with the other core rules (Rule 1). Our Rule 13 explainer covers it in more detail.
The DPO is responsible to the company's Board of Directors or similar governing body (s.10(2)(a)). Significant observations from the DPIA and audit go to the Data Protection Board (Rule 13).
The DPO and the Rule 9 contact
Every Data Fiduciary publishes the business contact of a person who can answer questions about processing (s.8(9), Rule 9). For an SDF, that published contact is the DPO's. Rule 9 also asks you to mention it in every response to a Data Principal.
Under s.10(2)(a), the DPO is also the point of contact for the grievance redressal mechanism. Plan the DPO's role together with your grievance process.
The Order's 'data audit' wording
The Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette of India, 6 October 2026), made under s.43, changes 'audit' to 'data audit' in s.10(2)(c)(ii). It is editorial and adds no new duty. Our post on the Order covers both of its changes.
Use 'data audit' when you write SDF policies, auditor engagement letters and board papers, so your wording matches the amended Act.
Preparing before any designation
- Run the Am I an SDF? check and the SDF self-assessment against the s.10 factors.
- Identify who could serve as an India-based DPO responsible to your Board of Directors.
- Shortlist independent data auditors.
- Draft a DPIA method, for example from the DPIA template.
- List the algorithmic software that processes personal data, for the Rule 13 due diligence.
- Map where personal data and related traffic data are stored, in case data the Central Government specifies must stay in India (Rule 13).
Preparation is not designation. Do not describe your organisation as an SDF unless a notification under s.10 covers it. Check with counsel.
How TruePrivacy helps
The SDF workspace records the designation, with its date and government notification reference; the India-based DPO, with an address in India and a grievance contact; and the independent data auditor.
Once you record a designation, yearly clocks start for the DPIA, the data audit and algorithmic due diligence. DPIAs can start from templates or blank, and the AI governance inventory lists the AI models and datasets you use.
Is my company a Significant Data Fiduciary?
Only if the Central Government notifies it, or a class it belongs to, under s.10. No SDF has been designated that we know of as of 4 November 2026.
Does an SDF's DPO have to be based in India?
Yes. s.10(2)(a) requires the DPO to be based in India and responsible to the Board of Directors or similar governing body.
How often must an SDF carry out a DPIA and audit?
Rule 13 requires a DPIA and an audit once every twelve months, with significant observations furnished to the Board.
Did the 2026 Order add new SDF duties?
No. S.O. 5458(E) changed 'audit' to 'data audit' in s.10(2)(c)(ii) and inserted 'of' in s.9(1). Both changes are editorial.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin