Significant Data Fiduciary

What a Significant Data Fiduciary is

Under Section 10, the government can designate a data fiduciary — or a whole class of them — as "Significant".

The choice weighs a few things. How much personal data do you hold? How sensitive is it? What is the risk to people's rights? What is the risk to the security of the State? It's not a punishment. It means closer checks on the biggest, riskiest data use.

The Act sets out the factors for designation. But the government has not yet notified the criteria or thresholds that decide who actually qualifies. Until it names specific Data Fiduciaries or classes of them, no one is a Significant Data Fiduciary. Numbers circulating in commentary — user-count thresholds and the like — are informed guesses, not notified law. So we don't repeat them here.

Track this in what's still pending →

What extra obligations apply if you're designated

These sit on top of the basic duties every data fiduciary has. These are notice, consent, security, breach reports and rights requests.

• An India-resident Data Protection Officer. They must report to your board or an equivalent senior body, not sit under the CTO or the legal team. They are the point of contact for the Board and for individuals.
• An independent data auditor.
• Periodic Data Protection Impact Assessments (DPIAs) and audits of your processing.
• Algorithmic due diligence — checking your algorithms don't put people's rights at risk (Rule 13).
• Possible limits on moving certain personal data outside India, where the government specifies (Rule 13).

These start from the date of designation, not before.

Should you prepare now?

Are you clearly large-scale or high-risk — very large user bases, sensitive data at scale? Then it can be sensible to start early. A qualified, board-reporting DPO and an independent auditor take time to line up. For everyone else, this is worth understanding, not acting on yet. This is general information, not legal advice. Assess your own position or take advice on it.

Sources

Law — every Data Fiduciary (DPDP Act, Section 8(3)). Will you use the data to decide about someone? Or share it with another Data Fiduciary? Then you must keep it complete, accurate and consistent.

Law — Significant Data Fiduciaries only (DPDP Rules, Rule 13(3)). A Significant Data Fiduciary must take care to check that the technical measures it uses for hosting, displaying, uploading, modifying, publishing, transmitting, storing, updating or sharing personal data, including algorithmic software, are not likely to put people's rights at risk. Rule 13 starts on 13 May 2027.

These are Indian duties. GDPR and the EU AI Act are EU laws. They are not Indian law.