Significant Data Fiduciary: who gets named, and what changes when you are

Every company that decides why and how personal data is used is a Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Most of them follow the same core duties: give notice, take consent, keep data safe, report breaches, and answer people's requests.

A small group carries more. The government can name a company, or a whole class of companies, as a Significant Data Fiduciary, or SDF. The label comes with extra duties and a higher penalty for missing them. This guide explains who is likely to be named, what changes, and how to prepare before a notification arrives.

What the label means

The SDF label is about risk, not size alone. Section 10 of the Act lets the Central Government name any Data Fiduciary, or any class of them, as significant. It does this by notification. You do not apply for it, and you cannot opt out of it.

The Act itself names no one. As of this writing, no list of Significant Data Fiduciaries has been published. When one is, it will come from the Ministry of Electronics and Information Technology (MeitY) in the Gazette.

The six factors the government weighs

Section 10(1) lists what the government will look at. Any one of them can be enough.

In practice, the first two factors will catch most businesses. Large banks, insurers, hospitals, telecom operators, big consumer platforms and companies that handle children's data at scale are the obvious candidates. But the law does not set a number, so there is no safe threshold to stay under.

A quick self-check

Only the Central Government decides who is an SDF. This check helps you plan, nothing more.

The extra duties, in plain words

Section 10(2) of the Act and Rule 13 of the DPDP Rules, 2025 add these duties on top of the ones every Data Fiduciary has.

1. Appoint a Data Protection Officer based in India. The DPO represents the company under the Act, answers to the board of directors, and is the contact point for complaints.
2. Appoint an independent data auditor. Someone outside the team that runs the systems checks whether the company actually follows the Act.
3. Run a Data Protection Impact Assessment every year. It describes whose data you process and why, the risks to those people, and how you manage the risks.
4. Run an audit every year. Both the assessment and the audit happen once in every 12 months, and the auditor sends a report of the significant findings to the Data Protection Board.
5. Check your algorithms. You must take care that software used to host, display, store, change or share data is not likely to put people's rights at risk.
6. Keep some data in India. The government can name categories of personal data, on a committee's advice, that an SDF must not send outside India, together with the traffic data about its flow.

The last duty is the one many teams miss. It turns an SDF label into a data localisation question. If your systems, backups or support tools send data abroad, you may need to change where they run.

The penalty for missing them

Failing the extra SDF duties can cost up to ₹150 crore per breach, under the Schedule to the Act. That sits alongside the other penalties, such as up to ₹250 crore for weak security safeguards. The full list, with an interactive picker, is in our guide to the DPDP Rules 2025.

When it applies

The DPDP Rules were notified on 13 November 2025 and switch on in stages. Rule 13, which sets the SDF duties, is in the group that applies from 13 May 2027. The yearly clock for the assessment and audit runs from the date a company is named, or from the date its class is named.

So the safe plan is to be ready by May 2027, even if you have not been named yet. A first impact assessment and a first audit are not things you can produce in a month.

How to get ready, in five steps

1. Name an owner now. Pick the person who would become your DPO, and give them a budget.
2. Map the data. List every system that holds personal data, what it holds, where it runs, and who can reach it. Our DPDP compliance checklist starts here.
3. Find what leaves the country. Backups, cloud regions, support desks, analytics and AI tools are the usual leaks.
4. Turn on the evidence. An auditor will ask for logs of who saw and changed what. A real audit trail is the cheapest way to pass.
5. Run a practice assessment. Write a first impact assessment on one high-risk system. It shows where the gaps are.

Where Samvrik fits

Samvrik runs inside your own environment, on your servers or private cloud, so data you must keep in India stays there. Every access, change and approval is logged, which gives your auditor the record they need without a scramble. See how Samvrik works.

Sources: Digital Personal Data Protection Act, 2023, Section 10 and Schedule; Digital Personal Data Protection Rules, 2025, Rule 13 (notified 13 Nov 2025). Plain summary, not legal advice.

Common questions