Free tool
SDF preparedness checker
Nine questions on the s.10 factors and the duties an SDF would have. It shows what to prepare. It does not decide whether you are an SDF.
Short answer
Only the Central Government makes an organisation a Significant Data Fiduciary, by notification under s.10, weighing factors such as the volume and sensitivity of data and the risk to Data Principals' rights. No thresholds are published, and no SDF has been designated that we know of (as of 4 November 2026). This tool is not a determination: it shows preparedness gaps against s.10(2) and Rule 13, such as an India-based DPO, an independent data auditor and a yearly DPIA and data audit.
Nine questions: four on the factors in s.10(1) and five on the duties an SDF would have under s.10(2) and Rule 13. Answer Yes, Partly, No or Not sure. This is not a determination: only the Central Government notifies SDFs, and no thresholds are published.
01 · Volume
Do you know roughly how many Data Principals' personal data you process, and in which systems?
02 · Sensitivity
Have you assessed which personal data you hold could cause the most harm to people if misused?
03 · Risk to rights
Have you assessed the risk your processing poses to Data Principals' rights?
04 · Wider impact
Have you considered whether your processing could affect the sovereignty and integrity of India, electoral democracy, security of the State or public order?
05 · DPO
Do you have a candidate for Data Protection Officer who is based in India and could be responsible to your Board of Directors?
06 · Data auditor
Have you identified an independent data auditor you could appoint?
07 · DPIA and data audit
Could you carry out a Data Protection Impact Assessment and a data audit every twelve months?
08 · Algorithms
Do you know which algorithmic software, including AI models, processes personal data in your organisation?
09 · Data in India
Could you keep specified personal data and its related traffic data within India if required?
Who decides whether you are an SDF
The Central Government notifies a Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciaries under s.10(1). The factors it may consider include:
- the volume and sensitivity of personal data processed
- the risk to the rights of Data Principals
- the potential impact on the sovereignty and integrity of India
- risk to electoral democracy
- security of the State
- public order
No numeric thresholds are published. A self-assessment cannot tell you whether you will be notified. Read more on the SDF explainer.
What a Significant Data Fiduciary must do
| Duty | Source |
|---|---|
| Appoint a Data Protection Officer who represents the SDF, is based in India, is responsible to the Board of Directors or similar governing body, and is the point of contact for grievances | s.10(2)(a) |
| Appoint an independent data auditor | s.10(2)(b) |
| Carry out a periodic DPIA, a periodic data audit and other measures | s.10(2)(c) |
| A DPIA and an audit once every twelve months, with significant observations furnished to the Board | Rule 13 |
| Due diligence that algorithmic software does not risk Data Principals' rights | Rule 13 |
| Keep personal data the Central Government specifies, on a committee's recommendation, and related traffic data within India | Rule 13 |
The Removal of Difficulties Order (S.O. 5458(E)) changed "audit" to "data audit" in s.10(2)(c)(ii). It adds no new duty.
What this tool does not do
This tool is educational, not legal advice and not a certification. It does not determine whether you are, or will be, a Significant Data Fiduciary: only a government notification under s.10 does that. If you think you may be notified, review your position with counsel.
How TruePrivacy helps
The SDF workspace records the designation (date and government notification reference), the India-based DPO with an address in India and a grievance contact, and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
AI governance keeps an inventory of the AI models and datasets you use, with assessments. Records of processing give your DPIA its description of processing.
How do I know if my company is a Significant Data Fiduciary?
Only a Central Government notification under s.10 makes an organisation an SDF. No thresholds are published, so no self-assessment can tell you.
Has any company been notified as an SDF?
None that we know of, as of 4 November 2026.
What must an SDF do under Rule 13?
Carry out a DPIA and an audit once every twelve months with significant observations furnished to the Board, carry out due diligence on algorithmic software, and keep personal data the government specifies, with related traffic data, in India.
Does an SDF's DPO have to be based in India?
Yes. Section 10(2)(a) requires the DPO to be based in India and responsible to the Board of Directors or similar governing body.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin