Significant Data Fiduciary

What a Significant Data Fiduciary is

Under Section 10, the government can designate a data fiduciary — or a whole class of them — as "Significant".

The choice weighs a few things. How much personal data do you hold? How sensitive is it? What is the risk to people's rights? What is the risk to the security of the State? It's not a punishment. It means closer checks on the biggest, riskiest data use.

Section 10 sets out the factors for designation. A notification may name a Data Fiduciary or a class. On 1 November 2026 we opened MeitY's What’s New index, but its notifications URL returned Page Not Found. PIB did not return the requested October coverage. We cannot confirm whether a designation has since been notified. The lack of numeric thresholds alone does not prove that no designation exists.

Confirmation pending

We do not treat numbers from commentary as notified law.

Track this in what's still pending →

What extra obligations apply if you're designated

These sit on top of the basic duties every data fiduciary has. These are notice, consent, security, breach reports and rights requests.

• An India-resident Data Protection Officer. They must report to your board or an equivalent senior body, not sit under the CTO or the legal team. They are the point of contact for the Board and for individuals.
• An independent data auditor.
• Periodic Data Protection Impact Assessments (DPIAs) and data audits of your processing (s.10(2)(c)(i)–(ii), read with S.O. 5458(E)).
• Algorithmic due diligence — checking your algorithms don't put people's rights at risk (Rule 13).
• Possible limits on moving certain personal data outside India, where the government specifies (Rule 13).

These start from the date of designation, not before.

Should you prepare now?

Good practice: Are you clearly large-scale or high-risk — very large user bases, sensitive data at scale? Then it can be sensible to start early. A qualified, board-reporting DPO and an independent auditor take time to line up. For everyone else, this is worth understanding, not acting on yet. This is general information, not legal advice. Assess your own position or take advice on it.

Sources

Law — every Data Fiduciary (DPDP Act, Section 8(3)). Will you use the data to decide about someone? Or share it with another Data Fiduciary? Then you must keep it complete, accurate and consistent.

Law — Significant Data Fiduciaries only (DPDP Rules, Rule 13(3)). A Significant Data Fiduciary must take care to check that the technical measures it uses for hosting, displaying, uploading, modifying, publishing, transmitting, storing, updating or sharing personal data, including algorithmic software, are not likely to put people's rights at risk. Rule 13 starts on the main-duty planning date.

These are Indian duties. GDPR and the EU AI Act are EU laws. They are not Indian law.