Section 10 · Rule 13
Rule 13 SDF: DPIA, DPO and data audit support
If the Central Government notifies you as a Significant Data Fiduciary, extra duties start. TruePrivacy records them and runs the yearly clocks.
Sample workspace
SDF workspace
- Rule 13DPIAMonth 3 of 12
- s.10(2)(c)Data auditMonth 3 of 12
- Rule 13Algorithmic due diligenceMonth 3 of 12
Set-up
- Designation recorded with notification reference
- DPO recorded with address in India
- Record independent data auditor
Short answer
Under s.10 of the DPDP Act, a Significant Data Fiduciary appoints a DPO based in India (s.10(2)(a)) and an independent data auditor (s.10(2)(b)), and carries out periodic DPIAs and data audits (s.10(2)(c)). Rule 13 sets a DPIA and an audit once every twelve months, with significant observations furnished to the Board, and due diligence that algorithmic software does not risk Data Principals' rights. TruePrivacy's SDF workspace records the designation, the DPO and the auditor, and starts yearly clocks once you record the designation.
What the SDF workspace does
Record the date and the government notification reference.
Record the DPO, their address in India and the grievance contact (s.10(2)(a)).
Record the auditor you appoint under s.10(2)(b).
Clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
Run impact assessments from templates or from blank.
The DPDP checklist marks controls compliant, partial or non-compliant, with a posture score from live records. It is a readiness view, not a certification.
How to prepare for SDF duties
- 01Check whether you could be notified
The Central Government notifies SDFs on factors such as the volume and sensitivity of data, the risk to Data Principals' rights, and potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order. Try the SDF self-check.
- 02Record the designation
Enter the date and notification reference. The yearly clocks start here.
- 03Appoint and record roles
Record the DPO, who is based in India and responsible to the Board of Directors or similar governing body, and the independent data auditor.
- 04Run the assessments
Complete the DPIA from a template, prepare for the data audit and carry out algorithmic due diligence before each clock runs out. The SDF DPIA template can help you structure the first one.
- 05Keep evidence
The audit trail logs every action with before and after values and exports as CSV.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Appoint a DPO based in India, responsible to the Board of Directors or similar body | s.10(2)(a) | DPO record with address in India and grievance contact |
| Appoint an independent data auditor | s.10(2)(b) | Auditor record |
| Periodic DPIA and data audit | s.10(2)(c), Rule 13 | DPIA templates and yearly clocks for the DPIA and the data audit |
| Due diligence that algorithmic software does not risk Data Principals' rights | Rule 13 | A yearly clock for algorithmic due diligence; see AI governance |
| Furnish significant observations to the Board | Rule 13 | Assessments and an exportable audit trail to prepare your submission from |
Before you plan for SDF duties
No Significant Data Fiduciary has been designated that we know of, and no Board members have been appointed yet. The Removal of Difficulties Order (S.O. 5458(E)) only changed 'audit' to 'data audit' in s.10(2)(c)(ii) and added no new duty. Whether you are an SDF depends on a government notification; plan with counsel.
Rule 13 also lets the Central Government, on a committee's recommendation, specify personal data that an SDF keeps in India along with related traffic data. Read Rule 13 explained for the full list of duties.
Works with
An inventory of AI models and datasets, with assessments.
Records of processingAn exportable record of processing activities for the DPIA and data audit.
Grievance redressalThe grievance desk your DPO answers for.
Data security postureIssues, identities and remediation across your data stores.
Who decides whether a company is a Significant Data Fiduciary?
The Central Government, by notification under s.10, based on factors such as the volume and sensitivity of data and the risk to Data Principals' rights. No SDF has been designated that we know of.
How often must an SDF do a DPIA and an audit?
Rule 13 sets a DPIA and an audit once every twelve months, with significant observations furnished to the Board.
Where must the DPO be based?
In India. The DPO represents the SDF, is responsible to the Board of Directors or similar governing body, and is the point of contact for grievances (s.10(2)(a)).
Did the October 2026 order add SDF duties?
No. S.O. 5458(E) is editorial: it changed 'audit' to 'data audit' in s.10(2)(c)(ii) and added no new duty.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin