Rights and duties
What is a Significant Data Fiduciary?
- Short answer
- A Data Fiduciary that the Central Government has notified as significant, judged on factors including the volume and sensitivity of data processed and risks to rights, electoral democracy, sovereignty and public order. It is a notification, not a size threshold you cross automatically.
You do not become an SDF by growing past a user count. The Government notifies a class or a specific Data Fiduciary, and until that happens the additional obligations do not apply to you.
Once notified, the extra duties are substantial: a Data Protection Officer based in India and answerable to the board, an annual DPIA, an independent data audit, and due diligence to verify that algorithmic software does not pose a risk to Data Principals' rights.
There is also a power to require that certain personal data and its traffic data stay within India, which takes effect only when specified.
Where this comes from
- Section 10, DPDP Act 2023
- Rule 13, DPDP Rules 2025
The mistake people make
Self declaring as an SDF because of scale, and taking on audit and DPIA obligations that were never triggered.