Significant Data Fiduciary
A Data Fiduciary designated by the Central Government under Section 10 of the DPDP Act 2023, subject to enhanced compliance obligations.
A Significant Data Fiduciary (SDF) is a Data Fiduciary that the Central Government notifies as such under Section 10(1) of the Digital Personal Data Protection Act 2023, based on factors including the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the risk to the sovereignty and integrity of India, and the risk to electoral democracy, security of the State or public order.
On notification, an SDF assumes three enhanced obligations under Section 10(2): appointing an India-based Data Protection Officer as the point of contact for the grievance mechanism, appointing an independent data auditor to conduct periodic data protection audits and Data Protection Impact Assessments, and undertaking other measures that may be prescribed. Rule 12 of the DPDP Rules 2025 sets out the DPO qualifications, publication requirements and reporting lines.
Non-SDF Data Fiduciaries may voluntarily adopt some SDF-tier controls (DPIA, audit) as part of their programme, but the mandatory obligations attach only on Central Government notification. As of 2026, no formal SDF notifications have been published in the Gazette, but the sectoral regulators (RBI, SEBI, IRDAI) have signalled expectations that regulated entities operate at SDF-equivalent standards.