What the Act asks of a Significant Data Fiduciary
Section 10 lets the Central Government single out fiduciaries whose processing carries greater risk, and attaches three further obligations to the designation.
Section 10(1) of the Act allows the Central Government to notify any data fiduciary, or class of data fiduciaries, as a Significant Data Fiduciary. The section lists the factors to be assessed: the volume and sensitivity of the personal data processed, the risk to the rights of data principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, security of the State, and public order, and such other factors as may be considered necessary.
The additional obligations
Under Section 10(2), a Significant Data Fiduciary must appoint a data protection officer who is based in India, who represents the fiduciary under the Act, who is responsible to its board of directors or similar governing body, and who is the point of contact for the grievance redressal mechanism. It must appoint an independent data auditor to evaluate its compliance with the Act. And it must undertake periodic data protection impact assessments and periodic audits, and observe such other measures as may be prescribed.
What the designation does not change
The designation adds to the general obligations in Section 8; it does not replace them. Every data fiduciary, significant or not, remains responsible for accuracy, security safeguards, breach intimation, erasure and a published contact. The Schedule to the Act sets a separate penalty ceiling for breach of the additional obligations in Section 10, up to one hundred and fifty crore rupees, alongside the ceilings that apply to the general obligations.
Why the Forum drafts against it
The Forum’s draft Significant Data Fiduciary Obligations Framework is written against Section 10 and the Rules made under it. The role of the data protection officer, the independence of the auditor, and the content of an impact assessment are the three questions that framework takes up. Like every framework in the register, it is a draft, it is the Forum’s reading and not the law, and it is published in the open so that the reading can be examined.
- The Digital Personal Data Protection Act, 2023, Sections 8, 10 and 33, and the Schedule.
Published 18 September 2026. This note is the Forum’s reading of the law, not the law. It carries no regulatory force.
Back to the Bulletin, or read the standards.