Section 10
Significant Data Fiduciary under DPDP
The Central Government can notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary. Designation brings extra duties under s.10 and Rule 13.
Short answer
Under s.10 of the DPDP Act, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary, based on factors such as the volume and sensitivity of data and the risk to Data Principals' rights. An SDF must appoint a Data Protection Officer based in India (s.10(2)(a)) and an independent data auditor (s.10(2)(b)), and Rule 13 adds a DPIA and an audit once every twelve months. No SDF has been designated that we know of.
How designation works (s.10(1))
The Central Government may notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary (SDF). It decides on factors such as:
- the volume and sensitivity of personal data processed;
- the risk to the rights of Data Principals;
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- the security of the State; and
- public order.
A notification can name a class of Data Fiduciaries, not only a single company. Until a notification names you, or a class you belong to, the s.10 duties do not apply to you.
No SDF has been designated that we know of. Designation comes by government notification, not self-assessment, but you can gauge your exposure with the Am I an SDF? tool.
What an SDF must do
| Duty | Provision | Detail |
|---|---|---|
| Appoint a Data Protection Officer | s.10(2)(a) | Represents the SDF, is based in India, is responsible to the Board of Directors or similar governing body, and is the point of contact for grievances |
| Appoint an independent data auditor | s.10(2)(b) | Appointed by the SDF to carry out data audits |
| Periodic Data Protection Impact Assessment | s.10(2)(c) | Once every twelve months under Rule 13 |
| Periodic data audit | s.10(2)(c)(ii) | Once every twelve months under Rule 13 |
| Report significant observations | Rule 13 | Significant observations from the DPIA and audit are furnished to the Board |
| Algorithmic due diligence | Rule 13 | Check that algorithmic software it uses does not risk Data Principals' rights |
| Keep specified data in India | Rule 13 | Personal data the Central Government specifies, on a committee's recommendation, and related traffic data stay within India |
| Other measures | s.10(2)(c) | Other measures under the Act |
The Data Protection Officer
The DPO must represent the SDF, be based in India, be responsible to the Board of Directors or a similar governing body, and be the point of contact for grievance redressal (s.10(2)(a)). Under Rule 9, the DPO's business contact is published on the website or app and mentioned in every response to a Data Principal.
Every fiduciary publishes a contact for questions about processing (Rule 9); for an SDF, that published contact is the DPO's. Our guide on appointing a DPO and the DPO appointment note help you document the role.
The Removal of Difficulties Order is editorial only
The Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette 6 October 2026), made under s.43, changes “audit” to “data audit” in s.10(2)(c)(ii). It adds no new duty for SDFs. The Order also made an editorial change to s.9(1), covered on the section 9 page. More in our note on the Order.
Preparing before any designation
- Map the volume and kinds of personal data you process, and where it is stored.
- Identify who could serve as an India-based DPO, and check that your Board of Directors or similar governing body can receive the DPO's reports (s.10(2)(a)).
- Run a DPIA on your highest-risk processing now, so the method is tested.
- List the algorithmic systems that touch personal data.
- Shortlist independent data auditors.
No SDF has been designated that we know of, and no one can say in advance whether you will be. If you think you could be, check with counsel.
How TruePrivacy helps
The SDF workspace records the designation (date and government notification reference), the India-based DPO (address in India and grievance contact) and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
DPIAs and PIAs run from templates or blank, and AI governance keeps an inventory of the AI models and datasets you use, with assessments. The Rule 13 page covers the yearly cycle in detail.
Who decides whether a company is a Significant Data Fiduciary?
The Central Government, by notification under s.10, based on factors such as the volume and sensitivity of data and the risk to Data Principals' rights.
Has any company been designated as an SDF?
None that we know of as of 4 November 2026.
Does every company need a DPO under DPDP?
No. The DPO duty in s.10(2)(a) applies to Significant Data Fiduciaries. Others publish the contact of a person who can answer questions about processing (Rule 9).
Did the October 2026 Order add new SDF duties?
No. S.O. 5458(E) changed “audit” to “data audit” in s.10(2)(c)(ii). It is editorial and adds no new duty.
Keep reading
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin