Additional obligations of Significant Data Fiduciary

1. (1)
   The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including—

   1. (a)
      the volume and sensitivity of personal data processed;
   2. (b)
      risk to the rights of Data Principal;
   3. (c)
      potential impact on the sovereignty and integrity of India;
   4. (d)
      risk to electoral democracy;
   5. (e)
      security of the State; and
   6. (f)
      public order.
2. (2)
   The Significant Data Fiduciary shall—

   1. (a)
      appoint a Data Protection Officer who shall—

      1. (i)
         represent the Significant Data Fiduciary under the provisions of this Act;
      2. (ii)
         be based in India;
      3. (iii)
         be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
      4. (iv)
         be the point of contact for the grievance redressal mechanism under the provisions of this Act;
   2. (b)
      appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
   3. (c)
      undertake the following other measures, namely:—

      1. (i)
         periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
      2. (ii)
         periodic audit; and
      3. (iii)
         such other measures, consistent with the provisions of this Act, as may be prescribed.

Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)