Significant Data Fiduciary

DPDP Act 2023 — Section 10

A Significant Data Fiduciary (SDF) is a Data Fiduciary notified by the Central Government based on factors including volume and sensitivity of personal data processed, risk to data principal rights, potential impact on sovereignty and security, and risk to electoral democracy. SDFs have additional obligations under Section 10 of the DPDP Act: appointment of a Data Protection Officer (DPO) based in India, appointment of an independent Data Auditor, periodic Data Protection Impact Assessments (DPIA), and compliance with additional prescribed requirements. Most large banks, public sector entities, social media platforms, and e-commerce companies are expected to be classified as SDFs.

Classification as a Significant Data Fiduciary under Section 10 of the DPDP Act 2023 lifts an institution into a heavier compliance tier, and large banks and public-sector entities should plan on the basis that they may be notified as such. The additional obligations are concrete: appoint a Data Protection Officer based in India, engage an independent Data Auditor, run periodic Data Protection Impact Assessments, and meet any further prescribed requirements. In practice this means board-level ownership, documented audit trails, and the ability to demonstrate compliance rather than merely assert it. The factors driving designation — volume and sensitivity of data, risk to data principals, and broader security considerations — mean an institution should self-assess before any government notification arrives. Getting this wrong is costly: an entity that operates as if it were an ordinary fiduciary while meeting the SDF thresholds is exposed if the Board later finds the heightened duties were ignored. Well-advised institutions prepare the SDF framework proactively.