A Significant Data Fiduciary (SDF) is a business the central government notifies under Section 10 of the DPDP Act, based on factors such as the volume and sensitivity of personal data, risk to individuals, and impact on sovereignty, security or public order. SDFs must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out an annual data protection impact assessment and audit (Rule 13). Breaching these duties can cost up to ₹150 crore.
- Who decides
- Central government, by notification
- DPO
- Mandatory, based in India
- DPIA and audit
- Every 12 months
- Penalty
- Up to ₹150 crore
How SDFs are chosen
There is no automatic numeric threshold. Section 10(1) lets the government notify a Data Fiduciary or class of them as SDFs after assessing:
- the volume and sensitivity of personal data processed;
- risk to the rights of Data Principals;
- potential impact on India's sovereignty and integrity;
- risk to electoral democracy;
- security of the State; and
- public order.
Large platforms, banks, insurers, telecom operators, health and edtech platforms processing children's data are the most likely candidates.
Extra duties of an SDF
- Appoint a Data Protection Officer based in India, who represents the SDF, reports to its board of directors or similar body, and is the point of contact for grievances.
- Appoint an independent data auditor.
- Carry out a data protection impact assessment (DPIA) and audit every 12 months and send the significant findings to the Board (Rule 13).
- Check that algorithmic software used to process personal data does not risk Data Principals' rights.
- Keep specified personal data and traffic data in India if the government restricts its transfer on a committee's recommendation.
Frequently asked questions
Has the government notified any Significant Data Fiduciaries?
As of October 2026, no list of SDFs had been notified. The Rule 13 duties apply from 13 May 2027.
Do businesses that are not SDFs need a DPO?
No. They must publish the contact details of a DPO, if they have one, or of a person who can answer questions about their data processing (Rule 9). Many appoint a DPO voluntarily.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.