Section 10
SDF self-assessment for Indian companies
Only the Central Government can make you a Significant Data Fiduciary. This self-assessment helps you judge your exposure and get ready in case it does.
Short answer
A company becomes a Significant Data Fiduciary only when the Central Government notifies it, alone or as part of a class, under s.10, and no numeric thresholds have been notified. The government weighs factors such as the volume and sensitivity of personal data, risk to Data Principals' rights, and potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order. Use those factors to judge your exposure, and run a gap check against s.10(2) and Rule 13 so you can act quickly if you are notified.
How SDF designation works
The government notifies SDFs; companies do not designate themselves. As of 4 November 2026 no thresholds have been notified, and we know of no designation. Treat this self-assessment as preparation, not a conclusion about your status.
Weigh your exposure against the s.10 factors
| s.10 factor | Questions to ask yourself |
|---|---|
| Volume of personal data | How many Data Principals do we serve in India, and how much data do we hold on each? |
| Sensitivity of personal data | Do we hold data whose exposure could seriously harm people, such as financial, health or identity data, or children's data? |
| Risk to Data Principals' rights | Do decisions about people rely on profiling or automated systems? Could an error deny someone a service? |
| Sovereignty and integrity of India | Do we process data at a scale or of a kind that matters to national interests? |
| Electoral democracy | Could our data or platform be used to influence voters or elections? |
| Security of the State | Do we serve government, defence or other critical functions? |
| Public order | Could misuse of our data or platform affect public order? |
The Act defines no sensitive categories; the examples above are prompts, not legal tests. Answer in words and keep the reasoning, because no score makes you an SDF.
Gap check against s.10(2) and Rule 13
| Duty | Source | Ready if you have |
|---|---|---|
| Data Protection Officer based in India, responsible to the board, point of contact for grievances | s.10(2)(a) | A named candidate and a draft board resolution |
| Independent data auditor | s.10(2)(b) | A shortlist and a scope of work |
| Periodic Data Protection Impact Assessment | s.10(2)(c) | A DPIA method and a first draft for your riskiest processing |
| Periodic data audit | s.10(2)(c) | Records an auditor can test |
| DPIA and audit every twelve months, significant observations to the Board | Rule 13 | A yearly calendar and a reporting owner |
| Algorithmic due diligence | Rule 13 | A list of algorithmic software that affects Data Principals, with reviews |
| Keeping specified data in India | Rule 13 | A map of where personal data and traffic data sit |
The Removal of Difficulties Order, 2026 (S.O. 5458(E)) changed "audit" to "data audit" in s.10(2)(c)(ii). It is editorial and adds no new duty.
Steps to run the self-assessment
- 01Gather facts
Collect the number of Data Principals, the data categories, products and sectors you serve.
- 02Answer the factor questions
Write an answer for each s.10 factor, with the evidence behind it.
- 03Run the gap check
Mark each s.10(2) and Rule 13 duty as in place, partial or not started.
- 04Decide your stance
Agree with leadership and counsel how far to prepare, and record the decision.
- 05Prepare the people
Identify a DPO candidate based in India and an independent data auditor you could appoint quickly.
- 06Review yearly
Repeat after major growth, a new product line or any government notification.
Readiness checklist
- Factor answers documented and reviewed by counsel
- DPO candidate identified, based in India
- Auditor shortlist ready
- DPIA method chosen and tested
- Algorithmic software list kept
- Data location map current
- Board briefed on SDF exposure
No SDF thresholds are notified, and the Data Protection Board has no members yet. Do not describe your company as an SDF, or as outside SDF scope, on the basis of this self-check.
How TruePrivacy helps
The SDF workspace records a designation with its date and government notification reference, the India-based DPO and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
Impact assessments run from templates or blank, AI governance keeps an inventory of the models and datasets you use, and data discovery shows data classes with record counts and high-risk stores. Related tools: Am I an SDF?, the DPIA template for SDFs and the DPO appointment note.
What makes a company a Significant Data Fiduciary?
A notification by the Central Government under s.10, based on factors such as the volume and sensitivity of data and risk to Data Principals' rights. No numeric thresholds have been notified.
Can we declare ourselves an SDF?
No. Only the government notifies SDFs. You can prepare by assessing your exposure and readiness.
What must an SDF do?
Appoint a DPO based in India and an independent data auditor, and carry out periodic DPIAs and data audits (s.10(2)). Rule 13 adds a yearly DPIA and audit, algorithmic due diligence, and keeping any data the government specifies in India.
Has any company been designated an SDF?
Not that we know of, as of 4 November 2026.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin