What is a Significant Data Fiduciary?
Under India's Digital Personal Data Protection Act, 2023 every organisation that decides why and how personal data is processed is a Data Fiduciary. A Significant Data Fiduciary (SDF) is a Data Fiduciary, or a whole class of them, that the Central Government notifies as significant. SDFs carry extra duties on top of everything else the Act and the DPDP Rules, 2025 require.
How the government decides
Section 10(1) of the Act lets the government designate an SDF after assessing factors that include:
- the volume and sensitivity of the personal data processed;
- the risk to the rights of Data Principals;
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- the security of the State; and
- public order.
There is no numeric threshold in the Act or the Rules, such as a number of users or a turnover figure. Designation happens only by notification, for one organisation or for a class of them. No SDF had been notified when we last checked, so the checker above estimates likelihood from the factors in Section 10; it cannot tell you that you are, or are not, an SDF.
The Act also has no separate "sensitive personal data" category of the kind found in older Indian rules or in GDPR. Sensitivity still matters, because it is one of the factors above.
What an SDF must do
| Duty | Source |
|---|---|
| Appoint a Data Protection Officer who represents the SDF under the Act, is based in India, answers to the board of directors (or similar governing body) and is the point of contact for grievances | Act s.10(2)(a) |
| Appoint an independent data auditor to evaluate compliance with the Act | Act s.10(2)(b) |
| Carry out a Data Protection Impact Assessment and an audit once every 12 months, counted from the date of designation | Act s.10(2)(c); Rule 13 |
| Have the person doing the assessment or audit send the Board a report of significant observations | Rule 13 |
| Check that technical measures, including algorithmic software used to process personal data, are not likely to pose a risk to Data Principals' rights | Rule 13 |
| Keep personal data that the government specifies (on a committee's recommendation), and its traffic data, within India | Rule 13 |
A Data Protection Impact Assessment, as the Act defines it, describes the rights of Data Principals and the purpose of processing, and assesses and manages the risk to those rights. These duties come into force with the main body of the Rules on 13 May 2027.
Penalty
Breaching the additional SDF obligations can attract a penalty of up to ₹150 crore under the Schedule to the Act. That is a ceiling: the Data Protection Board sets the actual amount after an inquiry. The other ceilings still apply to an SDF too, including up to ₹250 crore for failing to take reasonable security safeguards. Estimate your exposure with the DPDP penalty calculator.
Can a startup be an SDF?
The government can designate any Data Fiduciary. Separately, Section 17(3) lets it exempt notified Data Fiduciaries or classes, including recognised startups, from some provisions, among them Section 10. Neither happens automatically: both need a notification.
Preparing before any notification
The work an SDF must do is good practice for any organisation that processes a lot of personal data or sensitive data:
- Keep a current map of what personal data you hold, why, where, and who you share it with.
- Run an impact assessment on your highest-risk processing, especially children's, health and financial data.
- Name the person who will own privacy, and decide who would serve as DPO.
- Inventory the algorithms and models that make or support decisions about people.
- Know which data you hold outside India, in case localisation is specified.
- Get audit-ready: written policies, and evidence that your security controls work.
Read our guide to the DPDP Act and Rules 2025, or see our DPDP compliance services.
Sources
- Digital Personal Data Protection Act, 2023: s.2(z), s.10, s.17(3) and the Schedule (MeitY)
- Digital Personal Data Protection Rules, 2025: Rule 13 (MeitY)
Facts checked against the sources above on 22 October 2026. General information, not legal advice.