Glossary
What is a Significant Data Fiduciary under DPDP?
A Significant Data Fiduciary (SDF) is a Data Fiduciary the Central Government notifies for extra duties. The status comes from a notification, not from self-assessment.
Definition
Under s.2 of the DPDP Act, 2023, a Significant Data Fiduciary (SDF) is a Data Fiduciary or class of Data Fiduciaries notified by the Central Government under s.10. An SDF must appoint a Data Protection Officer based in India (s.10(2)(a)) and an independent data auditor (s.10(2)(b)), and Rule 13 adds a DPIA and an audit once every twelve months. No SDF has been designated that we know of, as of 4 November 2026.
What it means
The Central Government notifies SDFs based on factors such as the volume and sensitivity of personal data, risk to Data Principals' rights, potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order (s.10).
Until a notification covers you, the extra duties do not apply, but the factors help you judge your exposure. The Am I an SDF? tool and the SDF self-assessment guide walk through them.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.10 | The Central Government notifies SDFs on the listed factors |
| s.10(2)(a) | A DPO based in India, responsible to the Board of Directors or similar governing body |
| s.10(2)(b) | An independent data auditor |
| s.10(2)(c) | Periodic DPIA, periodic data audit and other measures |
| Rule 13 | DPIA and audit every twelve months; algorithmic due diligence; specified data kept in India |
| Rule 9 | Publish the DPO's business contact |
Common misconceptions
- “Large companies are SDFs automatically.” Only a Central Government notification under s.10 makes a Data Fiduciary an SDF.
- “The Removal of Difficulties Order added SDF duties.” S.O. 5458(E) only changed “audit” to “data audit” in s.10(2)(c)(ii). It adds no new duty.
- “Rule 13 requires all data to stay in India.” It covers personal data the Central Government specifies on a committee's recommendation, and related traffic data.
Related terms
The India-based officer a Significant Data Fiduciary appoints (s.10(2)(a)).
Data auditorThe independent auditor a Significant Data Fiduciary appoints (s.10(2)(b)).
Data FiduciaryDecides the purpose and means of processing personal data (s.2).
Data Protection BoardThe Board established under s.18; no members appointed yet.
In TruePrivacy
The SDF workspace records the designation (date and government notification reference), the India-based DPO and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
Has any company been designated an SDF?
None that we know of, as of 4 November 2026. Watch for Central Government notifications under s.10.
Does an SDF need a DPO in India?
Yes. s.10(2)(a) requires a DPO who represents the SDF, is based in India, is responsible to the Board of Directors or similar governing body, and is the point of contact for grievances.
How often must an SDF carry out a DPIA?
Rule 13 requires a Data Protection Impact Assessment and an audit once every twelve months, with significant observations furnished to the Board.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin