Significant Data Fiduciary
A Data Fiduciary that the Central Government notifies under Section 10 of India's DPDP Act, subject to extra duties covering DPO appointment, independent data audit and DPIAs.
Full Definition
A Significant Data Fiduciary (SDF) is a Data Fiduciary the Central Government has notified under Section 10(1) of the Digital Personal Data Protection Act, 2023 based on factors in Section 10(1): volume and sensitivity of personal data processed, risk to Data Principals, potential impact on India's sovereignty and integrity, risk to electoral democracy, risk to public order, and State security. The government is expected to notify SDFs by sector or by scale once the Act's core provisions commence on 13 May 2027; as of 1 November 2026, no SDF has been designated.
SDF status adds a layer of operational obligations under Section 10(2) and Rules 12–13. The SDF must appoint an India-based Data Protection Officer who reports to the board or senior management; appoint an independent data auditor to carry out a periodic data audit (as reworded by the DPDP Removal of Difficulties Order 2026); conduct Data Protection Impact Assessments for processing with elevated risk; and run algorithmic risk assessments where processing involves automated decision-making. These duties operate in parallel with the baseline Section 8 duties, not instead of them.
Related terms
Data Fiduciary
The Indian equivalent of a Data Controller under the DPDP Act — an entity that determines the purposes and means of processing personal data.
Data Protection Officer
An individual appointed to oversee an organisation's data protection strategy, advise on compliance, and act as the point of contact for regulators and data subjects.
Data Audit (SDF)
The periodic data audit a Significant Data Fiduciary must run under Section 10(2)(c)(ii) of the DPDP Act, as reworded by the Removal of Difficulties Order 2026.
DPIA
Data Protection Impact Assessment — a systematic process to identify and minimise privacy risks in new processing activities.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes