Rule 13
Rule 13 Significant Data Fiduciary duties
Rule 13 turns the s.10 duties of a Significant Data Fiduciary into a yearly cycle, adds checks on algorithmic software, and covers keeping specified data in India.
Short answer
Rule 13 of the DPDP Rules, 2025 requires a Significant Data Fiduciary to carry out a Data Protection Impact Assessment and an audit once every twelve months, with significant observations furnished to the Board. It must also check that algorithmic software it uses does not pose a risk to Data Principals' rights, and keep personal data the Central Government specifies, with related traffic data, within India. These duties sit alongside the India-based DPO (s.10(2)(a)) and independent data auditor (s.10(2)(b)) and start on 13 May 2027.
The Rule 13 checklist
| Duty | How often | Evidence to keep |
|---|---|---|
| Data Protection Impact Assessment | Once every twelve months | The DPIA report and the actions it led to |
| Audit | Once every twelve months | The audit report and your responses |
| Significant observations furnished to the Board | After each DPIA and audit | What was furnished and when |
| Algorithmic due diligence | Ongoing | An inventory of algorithmic software and the checks done |
| Keep specified data in India | Once the Central Government specifies the data | Where the specified personal data and related traffic data are stored |
These duties start on 13 May 2027 and apply only to a Data Fiduciary notified as a Significant Data Fiduciary under s.10. If a class of Data Fiduciaries is notified, each member of the class carries them.
Building the yearly cycle
- 01Record the designation
Note the notification date and reference, and plan the first twelve-month cycle from there.
- 02Scope the DPIA
Cover the processing that carries the most risk to Data Principals' rights.
- 03Engage the auditor early
Brief the independent data auditor appointed under s.10(2)(b) well before the audit is due.
- 04Furnish significant observations
Make sure significant observations from the DPIA and audit reach the Board.
- 05Close the loop
Track every action to completion before the next cycle starts.
How Rule 13 fits with s.10
| Section 10 | What it requires | What the Rules add |
|---|---|---|
| s.10(2)(a) | A DPO based in India, responsible to the Board of Directors or similar governing body, and the point of contact for grievances | The DPO's business contact is published and mentioned in every response (Rule 9) |
| s.10(2)(b) | An independent data auditor | An audit once every twelve months (Rule 13) |
| s.10(2)(c) | A periodic DPIA, a periodic data audit and other measures | A DPIA once every twelve months, algorithmic due diligence and keeping specified data in India (Rule 13) |
Whether you are an SDF at all depends on a notification under s.10; see Significant Data Fiduciary.
Algorithmic due diligence
Rule 13 asks an SDF to check that algorithmic software it uses does not pose a risk to the rights of Data Principals. That starts with knowing which models and automated systems touch personal data, for example scoring, ranking or recommendation systems.
Keep an inventory, assess each system against the rights in s.11 to s.14 and the accuracy duty in s.8(3), and record what you found and changed.
Keeping specified data in India
Rule 13 requires an SDF to keep personal data that the Central Government specifies, on the recommendation of a committee, together with related traffic data, within India. The duty attaches to the data that is specified, so keep track of any such specification and check with counsel how it applies to your systems.
This is separate from s.16, which lets the government restrict transfers by any fiduciary to countries it notifies. See cross-border transfers.
A note on “data audit”
The Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette 6 October 2026) changed “audit” to “data audit” in s.10(2)(c)(ii). It is editorial and adds no new duty.
No Significant Data Fiduciary has been designated that we know of. If you think you could be notified under s.10, plan the Rule 13 cycle with counsel.
How TruePrivacy helps
The SDF workspace records the designation (date and government notification reference), the India-based DPO and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
DPIAs run from templates or blank, the DPIA template for SDFs gives a starting structure, and AI governance keeps an inventory of the AI models and datasets you use, with assessments. Every action is logged in the audit trail, exportable as CSV.
How often must an SDF carry out a DPIA?
Once every twelve months under Rule 13, along with an audit.
Does Rule 13 apply to every company?
No. It applies only to a Data Fiduciary notified as a Significant Data Fiduciary under s.10. None has been designated that we know of.
What is algorithmic due diligence under Rule 13?
Checking that algorithmic software an SDF uses does not pose a risk to the rights of Data Principals.
Does Rule 13 require data localisation?
Only for personal data the Central Government specifies, on a committee's recommendation, and related traffic data, which an SDF must keep within India.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin