Are You a Significant Data Fiduciary? The SDF Test and What It Triggers

Section 10 of the DPDPA lets the Central Government notify any Data Fiduciary — or a whole class of them — as a Significant Data Fiduciary (SDF), attracting a heavier compliance tier.

The factors the government weighs

• Volume and sensitivity of personal data processed
• Risk to the rights of Data Principals
• Potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order

There is no self-assessment formula or numeric threshold: designation arrives by notification. Large consumer platforms, BFSI players, healthcare networks, telecoms and major employers are the obvious candidates — but classes of fintech or health-tech could be swept in wholesale.

What SDF status triggers

1. A Data Protection Officer based in India, who represents the SDF under the Act, answers to the board, and serves as the grievance contact.
2. An independent data auditor to evaluate compliance.
3. Periodic Data Protection Impact Assessments and audits — the DPDP Rules 2025 set the cadence (annual under the notified rules).
4. Algorithmic due diligence — verifying that algorithmic software deployed to process personal data does not pose a risk to Data Principals' rights.
5. Potential data localisation — the government may restrict specified data from leaving India for SDFs.

Penalty ceiling for failing SDF obligations: ₹150 crore.

Why non-SDFs should still care

Two reasons. First, you may become one overnight — designation is a notification, not a negotiation, and retrofitting a DPO office, audit trail and DPIA programme under deadline is expensive. Second, SDF obligations are simply what a mature privacy programme looks like; enterprise customers increasingly demand them contractually regardless of designation.

Getting ahead of it

• Track your data volumes and categories so you can anticipate designation.
• Stand up DPIA and audit processes now, lightweight but real — see the DPIA guide.
• Make evidence automatic rather than heroic.

Vivek, Data Adhikaar's DPIA agent, screens every new processing activity and prepares full assessments where risk warrants; Saakshi keeps the audit evidence current. Read the deeper guide: Significant Data Fiduciary.