Skip to main content
Significant Data Fiduciary: Should You Prepare? | Aizzentec — page loaded
Phase 3 enforcement: 13 May 2027. The runway is now.Speak to Aizzentec +91 8220 359 506
Compliance

Significant Data Fiduciary classification: should you self-prepare?

Volume isn't the only criterion. Five factors that increase your likelihood, and what to do before notification.

Compliance10 min read
By Praveen Kumar, Practice Leader — Risk, Cyber and AnalyticsCA, CISA, CEH, CDPSE, CFEPublished Updated

The criteria

Section 10(1) of the Act allows the Central Government to designate Significant Data Fiduciaries based on:

  • Volume and sensitivity of personal data processed
  • Risk to the rights of Data Principals
  • Potential impact on the sovereignty and integrity of India
  • Risk to electoral democracy
  • Security of the State
  • Public order

What this means in practice

The criteria are deliberately open-ended. The Government has not yet (as of late 2025) issued a formal threshold notification, but the criteria suggest several categories of organisation are highly likely candidates:

  • Large BFSI institutions (volume + sensitivity + sectoral)
  • Healthcare and HealthTech (sensitivity + risk to rights)
  • Telecommunications (volume + sovereignty)
  • Major social platforms (volume + electoral democracy)
  • Major e-commerce / D2C platforms (volume)
  • Major fintech (volume + sensitivity + sectoral)
  • Aadhaar-linked service providers (sensitivity + sovereignty)

Why pre-prepare?

Once designated, the Section 10 obligations apply with limited transition. Rule 13 specifies:

  • DPIA before processing involving 'high risk to the rights of Data Principals'
  • Annual independent audit by an empanelled auditor
  • India-resident Data Protection Officer
  • The DPO must report to the Board (or equivalent governing body)
  • Periodic risk assessment

Building these from scratch — particularly the audit cycle and the DPO function with board-reporting — takes 6-12 months. If you're notified in (say) Q3 2027 with a 6-month transition, and you haven't prepared, you'll miss the deadline.

The pre-preparation checklist

  1. Self-assess against the criteria (we've published guidance on this — see the SDF Classifier in our Tools section)
  2. If likely SDF: appoint an India-resident DPO with board reporting line. Use Template 13 for the role description.
  3. Stand up a DPIA programme. Run your first DPIA on the highest-risk processing activity. Use Template 12.
  4. Identify and pre-engage an audit firm (one that will be empanelled when the Government publishes the panel)
  5. Establish quarterly board reporting on DPDP risk. Use Template 16 for the board pack format.
  6. Document everything. The audit, when it comes, will examine whether the obligations were operationalised — not just declared.

If you're definitely not SDF

Even non-SDFs benefit from running a DPIA on high-risk processing, having a designated DPO, and reporting to the Board. The disciplines are valuable; only the legal obligation differs.

All knowledge articles

Related articles