Significant Data
Fiduciary

A Significant Data Fiduciary (SDF) is a class of data fiduciary that the Central Government notifies under Section 10 of the Digital Personal Data Protection Act, 2023. The designation is based on factors including the volume and sensitivity of personal data processed, the risk to the rights of data principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, and security of the State and public order. An organisation does not self-classify — it becomes an SDF only when notified by the government.

Beyond every ordinary data-fiduciary duty, an SDF must do three extra things under Section 10 and Rule 13: (1) appoint a Data Protection Officer based in India who represents the SDF and reports to its board; (2) appoint an independent data auditor to evaluate DPDP compliance; and (3) undertake periodic Data Protection Impact Assessments and audits, plus any other measures the government prescribes — such as restrictions on transferring certain personal or traffic data outside India.

Yes. A DPO is mandatory for an SDF. The DPO must be based in India, operate at senior-management level, report to the board of directors or equivalent governing body, and serve as the point of contact for the grievance-redressal mechanism. Their contact details must be published so data principals and the Data Protection Board can reach them directly.

A DPIA is a structured assessment of the rights of data principals and the risks arising from a processing activity, together with the measures taken to manage those risks. SDFs must conduct DPIAs periodically. A DPIA typically documents the purpose and necessity of processing, the categories of data and data principals involved, the risks identified, and the mitigation and safeguards applied — and is reviewed and approved by the DPO.

Breach of the additional obligations imposed on Significant Data Fiduciaries under Section 10 can attract a penalty of up to ₹150 crore, on top of penalties for any underlying failures such as inadequate security safeguards (up to ₹250 crore). Because these duties are designation-triggered and time-bound under the phased DPDP Rules 2025 deadlines, organisations likely to be notified should build their DPO, audit, and DPIA functions early. Tranquility Cybersecurity (TCSA) provides SDF-readiness support across all three.