[{"data":1,"prerenderedAt":283},["ShallowReactive",2],{"dpdp-\u002Fdpdp-act\u002Fsignificant-data-fiduciary":3},{"id":4,"title":5,"author":6,"body":7,"category":250,"date":251,"description":252,"draft":253,"extension":254,"eyebrow":255,"faq":256,"h1":263,"keywords":264,"meta":268,"navigation":269,"ogTitle":270,"path":271,"readingTime":272,"relatedArticles":273,"relatedServices":275,"seo":278,"stem":279,"tags":280,"updated":281,"__hash__":282},"dpdp\u002Fdpdp-act\u002Fsignificant-data-fiduciary.md","What Is a Significant Data Fiduciary?","DreamyHook Consultancy Services",{"type":8,"value":9,"toc":235},"minimark",[10,23,28,31,70,76,80,83,126,129,133,136,141,153,157,164,168,175,179,182,186,189,212,216,229],[11,12,13,14,18,19,22],"p",{},"Most organizations under the DPDP Act are ",[15,16,17],"strong",{},"Data Fiduciaries",". A subset — those that handle data at higher volume or higher risk — can be notified as ",[15,20,21],{},"Significant Data Fiduciaries (SDFs)",", and they carry extra duties. This guide explains who's likely an SDF and what it means.",[24,25,27],"h2",{"id":26},"what-makes-a-data-fiduciary-significant","What makes a Data Fiduciary \"significant\"",[11,29,30],{},"The government can notify an organization (or a class of them) as an SDF based on an assessment of relevant factors, including:",[32,33,34,42,48,55],"ul",{},[35,36,37,38,41],"li",{},"the ",[15,39,40],{},"volume and sensitivity"," of personal data processed,",[35,43,37,44,47],{},[15,45,46],{},"risk to the rights"," of Data Principals,",[35,49,50,51,54],{},"potential impact on ",[15,52,53],{},"the sovereignty and integrity of India",",",[35,56,57,58,61,62,65,66,69],{},"risks to ",[15,59,60],{},"electoral democracy",", ",[15,63,64],{},"state security",", and ",[15,67,68],{},"public order",".",[11,71,72,73],{},"There's no single magic number — it's a risk-based judgment. But as a rule of thumb, ",[15,74,75],{},"large user bases and sensitive data push you toward SDF territory.",[24,77,79],{"id":78},"whos-likely-an-sdf","Who's likely an SDF",[11,81,82],{},"Strong candidates include:",[32,84,85,95,104],{},[35,86,87,94],{},[15,88,89],{},[90,91,93],"a",{"href":92},"\u002Findustries\u002Ffintech","Fintech"," — sensitive financial and KYC data.",[35,96,97,103],{},[15,98,99],{},[90,100,102],{"href":101},"\u002Findustries\u002Fhealthtech","Healthtech"," — health records, often children's data.",[35,105,106,107,61,113,65,119,125],{},"Large ",[15,108,109],{},[90,110,112],{"href":111},"\u002Findustries\u002Fecommerce","e-commerce",[15,114,115],{},[90,116,118],{"href":117},"\u002Findustries\u002Fonline-gaming","online gaming",[15,120,121],{},[90,122,124],{"href":123},"\u002Findustries\u002Fmedia-adtech","media & social platforms"," — high volume, profiling, behavioural data.",[11,127,128],{},"If that sounds like you, plan as if you'll be notified.",[24,130,132],{"id":131},"the-extra-duties-of-an-sdf","The extra duties of an SDF",[11,134,135],{},"Being an SDF adds specific, ongoing obligations:",[137,138,140],"h3",{"id":139},"_1-appoint-a-data-protection-officer-dpo","1. Appoint a Data Protection Officer (DPO)",[11,142,143,144,147,148,152],{},"You must appoint a ",[15,145,146],{},"DPO based in India"," who reports to your board\u002Fgoverning body and acts as the point of contact for grievances. A senior in-house DPO can cost ₹20–40 lakh a year — which is why many organizations use ",[90,149,151],{"href":150},"\u002Fservices\u002Fdpo-as-a-service","DPO-as-a-Service"," instead.",[137,154,156],{"id":155},"_2-conduct-an-annual-dpia","2. Conduct an annual DPIA",[11,158,159,160,163],{},"A ",[15,161,162],{},"Data Protection Impact Assessment"," — a structured review of the risks your processing poses to Data Principals and how you mitigate them — must be carried out periodically (annually).",[137,165,167],{"id":166},"_3-undergo-an-annual-independent-audit","3. Undergo an annual independent audit",[11,169,170,171,174],{},"An ",[15,172,173],{},"independent data auditor"," must assess your compliance each year. Your DPO coordinates this and manages the evidence.",[137,176,178],{"id":177},"_4-other-measures","4. Other measures",[11,180,181],{},"The government may specify additional measures, which can include obligations around algorithmic processing and data flows.",[24,183,185],{"id":184},"why-this-matters-even-if-youre-not-sure","Why this matters even if you're not sure",[11,187,188],{},"Two reasons:",[190,191,192,198],"ol",{},[35,193,194,197],{},[15,195,196],{},"The duties are continuous."," A DPO, an annual DPIA, and an annual audit are a standing program, not a one-off — so it pays to design for them early.",[35,199,200,203,204,207,208,69],{},[15,201,202],{},"The penalties are higher."," Breaching SDF-specific obligations carries penalties up to ",[15,205,206],{},"₹150 crore",", on top of the general regime. See ",[90,209,211],{"href":210},"\u002Fdpdp-act\u002Fpenalties","Penalties & Enforcement",[24,213,215],{"id":214},"find-out-where-you-stand","Find out where you stand",[11,217,218,219,223,224,228],{},"Don't wait for a notification to start preparing. A ",[90,220,222],{"href":221},"\u002Fservices\u002Freadiness-audit","readiness audit"," gives you a likely SDF determination and a plan; the free ",[90,225,227],{"href":226},"\u002Fquick-scan","DPDP Quick Scan"," gives you an instant first read.",[230,231,232],"blockquote",{},[11,233,234],{},"General information, not legal advice. SDF status is determined by government notification — confirm your position with qualified advice.",{"title":236,"searchDepth":237,"depth":237,"links":238},"",3,[239,241,242,248,249],{"id":26,"depth":240,"text":27},2,{"id":78,"depth":240,"text":79},{"id":131,"depth":240,"text":132,"children":243},[244,245,246,247],{"id":139,"depth":237,"text":140},{"id":155,"depth":237,"text":156},{"id":166,"depth":237,"text":167},{"id":177,"depth":237,"text":178},{"id":184,"depth":240,"text":185},{"id":214,"depth":240,"text":215},"Obligations","2026-03-10","Significant Data Fiduciaries face extra DPDP duties — a DPO in India, annual DPIAs, and audits. Find out if you're likely one, and what it means.",false,"md","SDF",[257,260],{"q":258,"a":259},"How do I know if we're an SDF?","The government notifies SDFs based on factors like the volume and sensitivity of data, risk to Data Principals, and impact on sovereignty, security, and public order. There's no single number — but high volume or sensitive data makes it more likely. Our readiness audit assesses your likelihood.",{"q":261,"a":262},"What extra duties do SDFs have?","Appointing a Data Protection Officer based in India, conducting an annual Data Protection Impact Assessment, undergoing an annual independent data audit, and other additional measures the government may specify.","What is a Significant Data Fiduciary (SDF)?",[265,266,267],"Significant Data Fiduciary","SDF DPDP","DPDP DPO requirement",{},true,null,"\u002Fdpdp-act\u002Fsignificant-data-fiduciary","6 min read",[274,210],"\u002Fdpdp-act\u002Fwhat-is-dpdp-act",[276,277],"dpo-as-a-service","readiness-audit",{"title":5,"description":252},"dpdp-act\u002Fsignificant-data-fiduciary",[],"2026-05-23","H0597BdZs1pl2hmRWpbe-qmQS9twdSZWET3CmT0yDa0",1780230336124]