Significant Data Fiduciary (SDF): DPO and Audit Rules in India

A Higher Standard for Higher-Risk Processors

The DPDP Act 2023 creates a two-tier compliance framework. Every organisation that processes personal data must meet the baseline Data Fiduciary obligations. But certain organisations may be designated as Significant Data Fiduciaries (SDFs) by the Central Government, triggering an additional set of mandatory requirements.

The SDF designation is the Act’s mechanism for imposing proportionate obligations. Businesses that process large volumes of sensitive data face higher compliance standards than those handling minimal data.

Are You a Significant Data Fiduciary?

No organisation self-classifies into this category. Section 10(1) reserves the designation to the Central Government, which notifies a Data Fiduciary, or an entire class of Data Fiduciaries, by order. As of this writing, no class has been notified. There is no threshold that trips automatically and no register to enrol in.

What an organisation can assess is whether it sits inside the criteria the government weighs. Section 10(1) sets out six:

1. Volume of personal data processed. The scale of the processing operation, measured by how many Data Principals the organisation holds records on.
2. Sensitivity of the personal data processed. Financial, health, and biometric categories carry weight independent of volume.
3. Risk to the rights of Data Principals. The harm that would follow if the data were breached, misused, or made unavailable.
4. Potential impact on the sovereignty and integrity of India. Processing with a strategic or cross-border footprint.
5. Risk to electoral democracy. Platforms capable of influencing public opinion at scale.
6. Security of the State and public order. Data assets whose compromise carries consequences beyond the organisation holding them.

Two of these are not proxies for size. An organisation processing health or financial data at modest volume can satisfy criterion 2 while failing criterion 1. Reading the list as a headcount test is the common error.

The planning rule ConsentOS applies: an organisation that matches two or more criteria should build to the SDF standard before any notification arrives. This is a readiness posture, not a legal classification. It exists because the three additional obligations below carry procurement and hiring lead time that a notification period will not accommodate. For the compressed timeline now under discussion, see SDF classification and the November 2026 deadline.

The designation is not voluntary. Once notified, the organisation must comply with all SDF obligations within the prescribed timeframe.

Who Is Likely to Be Designated

While specific designations have not yet been issued, the following categories of businesses should prepare for potential SDF status:

• Large technology platforms: Social media, e-commerce, and digital services with millions of Indian users
• Financial institutions: Banks, insurance companies, and NBFCs processing extensive financial and identity data
• Telecom operators: Companies holding subscriber data, call records, and location information
• Healthcare platforms: Entities processing health records, diagnostic data, and prescription information
• Government contractors: Organisations processing personal data on behalf of government bodies

The Three Additional Obligations

SDFs must meet all seven standard Data Fiduciary obligations plus three additional requirements:

1. Data Protection Officer (DPO)

Every SDF must appoint a Data Protection Officer who:

• Is based in India: The DPO must be physically located in India, not operating remotely from another jurisdiction
• Acts as the Board’s point of contact: The DPO is the primary interface between the organisation and the Data Protection Board of India
• Represents the organisation: The DPO must hold the authority to make decisions and commitments on behalf of the organisation regarding data protection matters

The DPO role under the DPDP Act differs from the GDPR model. The GDPR emphasises DPO independence from management. The DPDP Act positions the DPO as a representative who acts on behalf of the organisation in its dealings with the Board.

Practically, the DPO should have:

• Direct reporting access to senior management or the board of directors
• Sufficient resources and authority to fulfil the role
• Knowledge of both the Act’s requirements and the organisation’s data processing activities
• Authority to halt processing activities that violate the Act

2. Data Protection Impact Assessment (DPIA)

SDFs must conduct periodic Data Protection Impact Assessments covering:

• Description of processing activities: What data is collected, from whom, for what purpose, and how it flows through the organisation
• Assessment of necessity: Whether each processing activity is necessary and proportionate to its stated purpose
• Risk identification: What risks the processing poses to Data Principals’ rights
• Mitigation measures: What controls are in place to address identified risks
• Residual risk evaluation: Whether remaining risks are acceptable after mitigation

The DPIA is not a one-time exercise. It must be conducted periodically and updated when processing activities change significantly. New products, new data sources, and new processing purposes all trigger DPIA requirements.

3. Independent Audit

SDFs must undergo periodic audits conducted by an independent Data Auditor. The auditor:

• Must be independent of the organisation being audited
• Must assess compliance with the Act’s provisions and the Board’s directions
• Must submit audit reports to the Data Protection Board

Rule 13 of the DPDP Rules sets the cycle: a Data Protection Impact Assessment and an audit once every twelve months, with significant observations reported to the Data Protection Board. Rule 13 is enforceable from 13 May 2027, so the current period is a preparation window rather than a live obligation. The twelve-month cycle is the number to budget and staff against.

Preparing for Potential Designation

Organisations that expect to be designated as SDFs should begin preparation now, even before formal designation:

1. Identify a DPO candidate: Determine who will serve as DPO. If no internal candidate has the required expertise, begin recruiting or developing the capability.

2. Conduct a baseline DPIA: Perform an initial Data Protection Impact Assessment covering all current processing activities. This establishes a baseline and identifies immediate risks.

3. Build an audit trail: Ensure all data processing activities are documented with sufficient detail to support an independent audit. This includes consent records, data flow maps, security controls documentation, and incident response records.

4. Establish governance structures: Create internal governance frameworks for data protection, including clear roles, escalation procedures, and decision-making authority.

5. Budget for compliance: DPO compensation, DPIA exercises, and independent audits represent ongoing costs. Factor these into operational budgets.

The Timeline

SDF designations are expected to begin as the enforcement date approaches in May 2027. The Central Government may issue designations in phases, starting with the largest and most data-intensive organisations.

Organisations that wait for formal designation before beginning preparation will face a compressed compliance timeline. Those that prepare in advance will transition more efficiently.

Penalties for SDF Non-Compliance

SDFs that fail to meet their additional obligations face the same penalty framework as other Data Fiduciaries, with the added scrutiny that comes with their designation. The Data Protection Board is likely to hold SDFs to a higher standard of accountability.

Failure to appoint a DPO, conduct DPIAs, or submit to independent audits breaches the additional obligations the Act places on Significant Data Fiduciaries under Section 10, carrying penalties of up to ₹150 crore per violation. A security-safeguard failure that causes a breach sits in a separate, higher tier of up to ₹250 crore.

Assess Your Position

Whether or not you expect SDF designation, understanding your compliance position is the first step. The free Compliance Vault Assessment evaluates your organisation across all five compliance areas and identifies gaps in your current data protection practices.