A Significant Data Fiduciary (SDF) is a company or class of companies that India’s Central Government notifies for extra duties under Section 10 of the DPDP Act, because of the volume and sensitivity of the personal data it handles or the risk it poses. If you are notified, you must appoint an India-based Data Protection Officer and an independent data auditor, and run a Data Protection Impact Assessment (DPIA) and an audit every twelve months.
No one has publicly been named an SDF yet, so this is the right time to work out where you might land. This guide explains who can be notified, what Rule 13 of the DPDP Rules, 2025 requires, when it starts to bite, and how to prepare. This is general information, not legal advice. Check the Act, the Rules and the latest government notifications, or speak to a qualified lawyer.
What is a Significant Data Fiduciary under the DPDP Act?
Under the DPDP Act, 2023, a Data Fiduciary is whoever decides why and how personal data is processed. Most fiduciaries share one baseline set of duties: notice, consent, security safeguards, breach reporting and deletion. A Significant Data Fiduciary carries those and more.
The label is not automatic and not based on a fixed turnover or user count written in the law. The Central Government has to notify a fiduciary, or a whole class of fiduciaries, after assessing relevant factors.
Who can be notified as an SDF? The Section 10 factors
Section 10 says the government may notify an SDF after assessing relevant factors, including:
- the volume and sensitivity of the personal data processed;
- the risk to the rights of Data Principals (the people the data is about);
- the potential impact on the sovereignty and integrity of India;
- the risk to electoral democracy;
- the security of the State; and
- public order.
Notice that size alone is not the test. A mid-sized company handling health or financial data at scale, or running automated profiling, could plausibly be assessed differently from a large company processing low-risk data. Some commentary online lists only four factors or quotes illustrative thresholds such as user counts; treat those with caution, because no official notification setting thresholds has been published in the sources I checked.
What does Rule 13 require from an SDF?
Rule 13 of the DPDP Rules, 2025 adds specific duties on top of the Act. In plain terms, an SDF must:
- Run a DPIA and an audit once every twelve months, counted from the date it is notified (or from when it joins a notified class), to check that it is observing the Act and the Rules.
- Send the Data Protection Board a report with the significant observations from the DPIA and audit, prepared by the person who carried them out.
- Verify its technical measures, including algorithmic software, used to host, display, upload, modify, publish, transmit, store, update or share personal data, so they are not likely to pose a risk to Data Principals’ rights.
- Follow data-localisation style restrictions: personal data that the Central Government specifies, on the recommendation of a committee, and its traffic data may not be transferred outside India.
Separately, Section 10(2) of the Act requires an SDF to appoint a Data Protection Officer who is based in India, represents the SDF under the Act, answers to its Board of Directors or similar governing body, and is the contact point for grievances. It must also appoint an independent data auditor.
Rule 13 versus the earlier draft
Be careful when reading older articles. The March 2025 draft rules numbered these duties differently (as Rule 12 and Rule 14). The final Rules place SDF obligations in Rule 13 and cross-border transfers in Rule 15.
When do the SDF obligations start?
The Rules were notified in mid-November 2025. Sources differ slightly on the exact date: the government’s summary says 14 November 2025, while law-firm notes cite the 13 November 2025 Gazette. Most provisions, including Section 10 and Rules 5 to 16, begin eighteen months after publication, which points to around 12 May 2027. The consent manager provisions start one year after publication, around November 2026.
There is also a built-in wait: the twelve-month DPIA and audit clock starts only once you are actually notified as an SDF, and no source I reviewed says when notifications will happen. So the practical window for preparation is now, not after a notification lands.
| Milestone | What applies | Approximate timing |
|---|---|---|
| Immediate | Foundation provisions and Rules 1, 2, 17 to 21 | November 2025 |
| After one year | Consent manager provisions (Rule 4) | November 2026 |
| After eighteen months | Most duties, including Section 10 and Rule 13 | Around May 2027 |
How to prepare for SDF status: a practical checklist
- Map your data. Know what personal data you hold, how much, how sensitive it is, and where it flows, including to AI tools and vendors.
- Do a mock DPIA. Pick your riskiest processing activity and document the risks to individuals and your controls.
- Review algorithms and automation. Rule 13 explicitly mentions algorithmic software. If you use AI for profiling or decisions, see our guide to AI agents and the DPDP Act.
- Plan the DPO role. It must sit in India and report into the Board, so decide who it will be and how it fits your governance.
- Check where data is stored. Know which systems and vendors sit outside India in case localisation directions arrive.
- Tighten the basics. Breach readiness matters for everyone; read our explainer on the 72-hour breach notification rule.
What about penalties?
The Act’s Schedule sets maximum penalties by type of breach, with the highest being up to Rs 250 crore for failing to maintain reasonable security safeguards. Some sources quote a separate figure for breaching SDF obligations, but I could not confirm that against the Schedule itself, so check the official text. Our post on DPDP Act penalties walks through the confirmed figures.
Frequently asked questions
Who decides whether a company is a Significant Data Fiduciary?
The Central Government. It can notify a single fiduciary or a class of fiduciaries after assessing the Section 10 factors. A company cannot self-declare, although it can prepare as if it might be notified.
Is there a user-count or revenue threshold for SDF status?
Not in the Act or Rules text I reviewed. The factors are qualitative, such as volume and sensitivity of data and risk to individuals. Illustrative thresholds quoted in some commentary are not official.
Does a Significant Data Fiduciary need a DPO in India?
Yes. Section 10(2) requires a Data Protection Officer based in India who is responsible to the Board of Directors or similar governing body.
How often must an SDF run a DPIA and audit?
Rule 13 requires both once in every period of twelve months, counted from notification, with a report of significant observations sent to the Data Protection Board.
Can an SDF transfer data outside India?
Only subject to the Rules. Data the government specifies, along with its traffic data, may not be transferred outside India. Other transfers are governed by the general cross-border provisions.
Conclusion
Significant Data Fiduciary status is about risk and scale, decided by the government, and it brings annual DPIAs, audits, an India-based DPO, an independent auditor and possible localisation limits. Start with a data map and a mock DPIA now, so that a notification is a formality rather than a scramble. For the wider picture, see how children’s data rules also raise the compliance bar.
Disclaimer: This article is for general information and is not legal advice.