Are you a Significant Data Fiduciary?

You are a Significant Data Fiduciary. You are a Significant Data Fiduciary: Section 10(2) and Rule 13 apply to you.

Section 2(z) defines a Significant Data Fiduciary as any Data Fiduciary or class of Data Fiduciaries notified by the Central Government under Section 10. Section 10(2) then requires you to (a) appoint a Data Protection Officer who represents you under the Act, is based in India, is an individual responsible to your Board of Directors or similar governing body, and is the point of contact for grievance redressal; (b) appoint an independent data auditor to evaluate your compliance with the Act; and (c) undertake periodic Data Protection Impact Assessments, periodic audits and such other measures as may be prescribed. Rule 13, which applies from 13 May 2027, adds the detail: a Data Protection Impact Assessment and an audit once in every period of twelve months from the date of notification, with a report of significant observations furnished to the Board; due diligence that technical measures, including algorithmic software, are not likely to pose a risk to the rights of Data Principals; and no transfer outside India of personal data, or the traffic data pertaining to its flow, that the Central Government specifies on the recommendation of a committee. The Schedule sets the penalty for breach of the Section 10 obligations at up to one hundred and fifty crore rupees.

Rests on: Section 10 — Additional obligations of Significant Data Fiduciary, Section 2 — Definitions, Rule 13 — Additional obligations of Significant Data Fiduciary, The Schedule — The Schedule — Penalties (see section 33)

You are not a Significant Data Fiduciary — and you cannot self-designate. You are not a Significant Data Fiduciary, and you cannot designate yourself one.

Under Section 10(1) only the Central Government may notify a Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine. The factors the section names are the volume and sensitivity of personal data processed; risk to the rights of Data Principals; potential impact on the sovereignty and integrity of India; risk to electoral democracy; security of the State; and public order. Section 2(z) confirms that the status exists only by notification. Until a notification names you or your class, the additional obligations in Section 10(2) and Rule 13 do not attach; the general obligations of every Data Fiduciary in Chapter II still do. If your processing is large in volume or sensitive, or bears on the listed interests, watch for notifications under Section 10(1).

Rests on: Section 10 — Additional obligations of Significant Data Fiduciary, Section 2 — Definitions, Rule 13 — Additional obligations of Significant Data Fiduciary