DPDP: are you a Significant Data Fiduciary?
Some organisations carry extra DPDP duties: an India-based Data Protection Officer, yearly audits and impact assessments. Here is who they are, and why growing companies should look ahead.
The DPDP Act applies to everyone who handles personal data, but a smaller group carries heavier duties. They are called Significant Data Fiduciaries (SDFs).
Like the other main duties, they start on 13 May 2027.
Who counts
You do not become an SDF by size alone. The Central Government notifies the organisations, or classes of organisations, that it treats as significant, looking at things such as how much personal data they handle, how sensitive it is, and the risk to the people concerned. Large platforms that handle sensitive information at scale are the obvious candidates, so check whether you have been notified rather than assuming.
What changes if you are one
Section 10 adds three duties on top of the ordinary ones:
- A Data Protection Officer who is based in India, answers to the board or equivalent governing body, and is the contact for people's grievances.
- An independent data auditor who audits how you handle data.
- Impact assessments and periodic audits. Under the Rules, the assessment and audit are repeated once every twelve months, and you must also check that the technical systems you use, including algorithms, are unlikely to put people's rights at risk.
What it costs to get it wrong
Breaching the extra SDF duties carries a penalty of up to ₹150 crore. Separately, and for everyone, failing to keep personal data reasonably secure can cost up to ₹250 crore. These are ceilings, not predictions: the Board decides the amount in each case.
What to do if you are growing fast
If you expect to reach millions of users, you do not need to appoint an auditor today. But privacy stops being an IT chore and becomes a board-level matter, so build the habits early: keep a record of what data you hold, document who is accountable, and keep your risk assessments on file.
Simple rule: the bigger and more sensitive your data, the more the law expects. Find out early whether the Government has put you in that group.
Take the free DPDP check to see where you stand, or read about our DPDP services.
General information, not legal advice. Check the Act and Rules before relying on it.