Significant Data Fiduciaries: Additional Obligations Under the DPDP Act
· Sri Tulasi Tech Labs
The DPDP Act lets the Central Government notify certain Data Fiduciaries, or classes of them, as Significant Data Fiduciaries (SDFs). They carry additional obligations because their processing poses higher risk.
Who can be a Significant Data Fiduciary?
The Government considers factors such as:
- the volume and sensitivity of personal data processed;
- the risk to the rights of Data Principals;
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- security of the State and public order.
Large consumer platforms, financial services and health data processors are the kinds of organisations likely to be considered.
The additional obligations
A Data Protection Officer based in India
An SDF must appoint a Data Protection Officer who represents it under the Act, is based in India, is responsible to its board of directors or similar governing body, and is the point of contact for grievance redressal.
An independent data auditor
An SDF must appoint an independent data auditor to evaluate its compliance with the Act.
Impact assessments and audits
Under the DPDP Rules, 2025, an SDF must carry out a Data Protection Impact Assessment and an audit once every twelve months, and share the significant observations with the Data Protection Board.
Due diligence on technology
SDFs must verify that the technical measures they use — including algorithmic software — do not pose a risk to the rights of Data Principals.
Restrictions on certain data
The Government may require that specified personal data processed by SDFs, and related traffic data, is not transferred outside India, based on the recommendations of a committee it constitutes.
The penalty
Failing to meet the additional obligations of an SDF can attract a penalty of up to ₹150 crore.
Preparing even if you are not notified
Many organisations adopt parts of these practices voluntarily — a named privacy lead, periodic impact assessments and independent reviews — because they make compliance easier to demonstrate and build trust with customers.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.