Request a callback

Tool · Free · No sign-up

Am I a Significant Data Fiduciary?

Go through the factors the Government weighs under s. 10(1), see how many point to you, and see what you must do if you are notified.

Your answers

1. Has the Central Government notified you, or a class of Data Fiduciaries you belong to, as Significant Data Fiduciaries?

Notifications are published in the Gazette and listed in the regulatory tracker.

2. The factors in s. 10(1)

The Act names these factors and sets no threshold for any of them, nor does it define sensitive personal data. Answer as you expect the Government would see your business.

s. 10(1)(a) · Volume and sensitivityDo you process a large volume of personal data, or personal data that is sensitive?
s. 10(1)(b) · Risk to Data PrincipalsCould the way you process personal data put Data Principals' rights at risk?
s. 10(1)(c) · Sovereignty and integrityCould your processing affect the sovereignty and integrity of India?
s. 10(1)(d) · Electoral democracyCould your processing pose a risk to electoral democracy?
s. 10(1)(e) · Security of the StateCould your processing affect the security of the State?
s. 10(1)(f) · Public orderCould your processing affect public order?

Nothing you enter leaves your browser.

Your answer

Answer the questions to see how many of the factors point to you.

Only a notification by the Central Government makes a Data Fiduciary significant. The Act sets no threshold, and the Government may weigh factors beyond these six.

Applies from 13 May 2027

If you are notified

On top of every other duty in the Act. Breaching these carries a penalty of up to Rs 150 crore (the Schedule, item 4).

  • Appoint a Data Protection Officer based in India, responsible to your board, who represents you under the Act and is the contact for grievances.

    s. 10(2)(a)
    Read s. 10

  • Appoint an independent data auditor to evaluate your compliance with the Act.

    s. 10(2)(b)
    Read s. 10

  • Carry out a Data Protection Impact Assessment and an audit every 12 months from the date you are notified.

    s. 10(2)(c); Rule 13(1)
    Read Rule 13

  • Have the person who carries them out send the Board a report of their significant observations.

    Rule 13(2)
    Read Rule 13

  • Check that your algorithmic software is not likely to put Data Principals' rights at risk.

    Rule 13(3)
    Read Rule 13

  • Keep the personal data the Government specifies, and the traffic data about its flow, inside India.

    Rule 13(4)
    Read Rule 13

  • Publish your Data Protection Officer's contact on your website or app, and give it in every reply to a rights request.

    Rule 9
    Read Rule 9

How the Government decides

Under s. 10(1), the Central Government may notify any Data Fiduciary, or a class of them, as a Significant Data Fiduciary after assessing the factors it considers relevant. The six in the Act are where that assessment starts: the volume and sensitivity of the personal data processed, the risk to Data Principals' rights, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order.

A notified Data Fiduciary takes on the duties in s. 10(2) and Rule 13, which apply from 13 May 2027. The yearly assessment and audit run from the date of notification.

What a Significant Data Fiduciary must do

Source: DPDP Act 2023 and DPDP Rules 2025, as published in the Gazette of India. The ceiling is the most the Board may impose under the Schedule.

DutyPenalty ceilingStatus
A Data Protection Officer based in IndiaDPDP Act 2023, s. 10(2)(a)Rs 150 crore (item 4)Upcoming · 13 May 2027
An independent data auditorDPDP Act 2023, s. 10(2)(b)Rs 150 crore (item 4)Upcoming · 13 May 2027
A Data Protection Impact Assessment and an audit every 12 monthsDPDP Act 2023, s. 10(2)(c); DPDP Rules 2025, Rule 13(1)Rs 150 crore (item 4)Upcoming · 13 May 2027
A report of significant observations to the BoardDPDP Rules 2025, Rule 13(2)Rs 150 crore (item 4)Upcoming · 13 May 2027
Due diligence on algorithmic softwareDPDP Rules 2025, Rule 13(3)Rs 150 crore (item 4)Upcoming · 13 May 2027
Specified personal data kept in IndiaDPDP Rules 2025, Rule 13(4)Rs 150 crore (item 4)Upcoming · 13 May 2027
The Data Protection Officer's contact publishedDPDP Act 2023, s. 8(9); DPDP Rules 2025, Rule 9Rs 50 crore (item 7)Upcoming · 13 May 2027

Sources: DPDP Act 2023, ss. 8(9) and 10 and the Schedule; DPDP Rules 2025, Rules 9 and 13

This page explains the law in plain English. It is not legal advice.