Key takeaways
- The Central Government designates Significant Data Fiduciaries based on data volume and sensitivity, risk to Data Principals, and risk to electoral democracy, public order or sovereignty.
- SDFs must appoint an India-based Data Protection Officer, conduct annual Data Protection Impact Assessments and undergo annual independent data audits.
- SDFs with algorithms that materially affect individuals must conduct algorithmic transparency and fairness assessments.
What makes a fiduciary "significant"
Section 10 of the DPDP Act lets the Central Government designate a Data Fiduciary — or a class of fiduciaries — as a Significant Data Fiduciary. The criteria include the volume and sensitivity of personal data processed, the risk of significant harm to Data Principals, the risk to electoral democracy, and the potential impact on public order, national security or sovereignty.
Designation can happen by named entity or by class (for example, a category of platforms with large user bases). Even before designation, fiduciaries should assess their likelihood of being designated and plan accordingly.
The SDF obligations
Data Protection Officer
An SDF must appoint a Data Protection Officer based in India and register the DPO with the Data Protection Board. The DPO represents the SDF under the Act — a named, accountable individual, not an anonymous mailbox.
Data Protection Impact Assessment
An SDF must conduct a DPIA before processing that poses high risk to Data Principals, and review it periodically. The Rules require the DPIA to be undertaken at least annually. A DPIA should cover processing purposes, data categories, risk to individuals and mitigation measures.
Independent data audit
An SDF must undergo an annual independent data audit conducted by a registered auditor and publish the audit report. "Independent" is the operative word — the audit must come from outside the organization's own compliance team.
Algorithmic transparency and fairness
Where an SDF's algorithms materially affect individuals, the SDF must undertake algorithmic transparency and fairness assessments. This provision is a bridge between data protection and AI governance: for teams building AI or agentic systems, it makes fairness evaluation a legal requirement rather than a best practice.
Who else should adopt these practices
Most organizations will not be designated SDFs — but the SDF regime signals where the regulator expects the strongest evidence. Non-SDF fiduciaries should adopt proportionate versions: a named privacy owner, light-weight impact assessments for high-risk processing and periodic internal audits. That is also the pragmatic path if designation risk changes over time.
Planning for designation
- Track the criteria: monitor volumes, sensitivity and systemic risk to anticipate designation.
- Stand up a DPO function: even if designation is not certain, define the role, authority and reporting line.
- Build a DPIA playbook: templates, risk scoring and review cadence that can scale from light to annual rigor.
- Prepare for audit: keep evidence versioned and traceable so an independent auditor and the Board can verify controls.
Prepare for SDF obligations before designation
KryptoMindz helps platforms stand up DPO functions, DPIA programs, audit readiness and algorithmic fairness assessments.
Discuss Your SDF Readiness