India's Digital Personal Data Protection (DPDP) Act applies to every Data Fiduciary — but a subset of organisations carry a heavier load. If the Central Government notifies you as a Significant Data Fiduciary (SDF), you inherit three additional, audit-visible obligations on top of every baseline duty: a Data Protection Officer based in India and answerable to your Board, an independent data audit, and periodic Data Protection Impact Assessments. This is the obligation map, who gets designated, and how to be ready before the notification rather than after.
An SDF is not a category you opt into; it is one the government designates. Under the Act, the Central Government may notify a Data Fiduciary or a class of them as significant based on factors including the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential effect on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order. Large consumer platforms, major BFSI and fintech players, big health-data and ad-tech processors, and telecoms are the obvious candidates. The framing below draws on the Act and on the Digital Personal Data Protection Rules, 2025, which MeitY notified by G.S.R. 846(E) dated 13 November 2025 and published in the Gazette on 14 November 2025. That notification is what turned the Act's duties into a dated compliance programme — see the timeline below. Verify exact thresholds against the notified Rules, as the operational detail lives there.
When this actually bites — the Rules 2025 clock
The DPDP Act received assent in 2023, but for two years it had no operational deadlines. The Digital Personal Data Protection Rules, 2025 supplied them. MeitY notified the Rules by G.S.R. 846(E), dated 13 November 2025 and published in the Gazette on 14 November 2025 — you will see both dates cited, and they refer to the signing and the publication respectively. The Rules commence in phases rather than all at once, which is why an organisation can be simultaneously in-scope and not yet in breach.
| Phase | Approx. date | What starts applying |
|---|---|---|
| On notification | 14 Nov 2025 | Provisions constituting the Data Protection Board of India |
| +12 months | ~14 Nov 2026 | Consent Manager obligations — registration and the framework around it |
| +18 months | ~14 May 2027 | Data Fiduciary obligations in substance, with the Board's adjudicatory and penalty powers fully live |
DPDP Rules, 2025 — phased commencement, measured from the 14 November 2025 publication
One nuance worth getting right, because it changes the budget line: the Act describes the SDF's audit and impact assessment as periodic, while the Rules set the cadence. Read together, the operative expectation is annual — an annual independent data audit and an annual DPIA, alongside algorithmic transparency and fairness assessment and enhanced due diligence on technical measures. Treat these as a recurring programme with an owner and a calendar, not a one-off project that closes.
The three SDF obligations
Section 10 of the Act sets out the additional duties for an SDF. Each is designed to be externally visible — a named accountable person, an independent assurance opinion, and a documented risk assessment — so the regulator can test compliance without sitting inside your systems.
| Obligation | What it requires | What you must be able to show |
|---|---|---|
| Data Protection Officer (DPO) | An individual based in India, responsible to the Board or governing body; the point of contact for grievance redressal | DPO appointment, India residency, Board reporting line, published contact channel |
| Independent data audit | Appoint an independent data auditor to evaluate compliance with the Act | Auditor engagement, scope, and the audit report with findings and closure |
| Periodic DPIA + audit | Undertake Data Protection Impact Assessments and periodic audits, plus other prescribed measures | DPIA records per high-risk processing, periodicity, and remediation trail |
Significant Data Fiduciary — the three additional obligations
1. A Data Protection Officer — in India, answerable to the Board
The DPO requirement is more specific than the EU's. The Act requires the DPO to be based in India and to be responsible to the Board of Directors or the equivalent governing body — meaning the role cannot be a distant group-privacy function or a purely advisory contractor. The DPO is also the published point of contact for grievance redressal, so the appointment has to be real, resourced, and reachable by Data Principals.
- Appoint a DPO who is genuinely based in India, with a documented reporting line to the Board or governing body.
- Resource the role — authority to influence processing decisions, access to the Board, and a grievance-handling workflow behind the published contact.
- Publish the DPO contact and wire it into your notice, privacy policy, and Data-Principal request channels.
2. An independent data audit
An SDF must appoint an independent data auditor to evaluate its compliance with the Act. 'Independent' is the operative word — the auditor must be able to render an objective opinion, which means separating the audit from the team that built and runs the processing. Treat this like a financial audit: defined scope, evidence-based testing of the baseline and SDF obligations, a report with findings, and tracked closure.
3. Periodic Data Protection Impact Assessment
A DPIA is a structured review of a processing activity: what personal data is processed, for what purpose and on what lawful basis, the risks to Data Principals, and the measures that manage those risks. For an SDF the Act expects DPIAs to be periodic — tied to new or changed high-risk processing — alongside periodic audits and any further measures the Rules prescribe.
- Maintain a data-processing inventory — systems, purposes, lawful basis, retention, cross-border flows and processors — as the foundation every DPIA reads from.
- Trigger a DPIA on any new or materially changed high-risk processing (new data category, new purpose, new third party, profiling, large-scale or sensitive processing).
- Document residual risk and the controls that reduce it; route material residual risk to the DPO and Board for a decision.
- Re-run DPIAs periodically and feed their findings into the independent data audit so the two reinforce rather than duplicate.
SDF vs the GDPR's 'high-risk' regime
- Designated by the Central Government, not self-assessed
- DPO must be based in India and responsible to the Board
- Mandatory independent data audit of Act compliance
- Periodic DPIA + periodic audit as standing duties
- DPO required on defined triggers, self-assessed
- DPO can sit anywhere, independent of management
- No blanket independent-audit mandate
- DPIA required for high-risk processing, not a periodic audit pairing
The practical takeaway for multinationals: a mature GDPR programme is a strong head start but not a drop-in. The India-residency and Board-responsibility of the DPO, the standing independent data audit, and the government-designation model are DPDP-specific. Map your existing privacy controls onto the DPDP and SDF obligations rather than assuming equivalence.
Your next 30 / 60 / 90 days
- Assess SDF likelihood honestly against the designation factors — volume and sensitivity of data, risk to principals, and the public-interest dimensions. If you are a large consumer, BFSI, fintech, health or ad-tech processor, prepare as if designation is coming.
- Build the data-processing inventory and data-flow map — nothing downstream works without it.
- Appoint (or formally designate) an India-based DPO with a real Board reporting line and a working grievance channel; publish the contact.
- Stand up the DPIA process and run it against your highest-risk processing first.
- Commission a readiness data audit so the statutory independent audit confirms control rather than finding gaps.
- Tighten the breach-response path — detection, Board/Data-Protection-Board notification, and Data-Principal notification — and rehearse it.
How Macksofy helps
Macksofy helps Data Fiduciaries and prospective SDFs get DPDP-ready and stay ready: data-flow mapping and DPIAs, readiness data audits ahead of the statutory independent audit, DPO-function and grievance-workflow design, and the technical assurance — VAPT, breach-readiness and DFIR — that the security-safeguards duty demands. See the DPDP Rules 2025 compliance calendar for the phased dates every Data Fiduciary is working to, our Significant Data Fiduciary engagement, the baseline DPDP readiness audit, VAPT for the reasonable-security-safeguards testing, DFIR for breach readiness and response, the CERT-In empanelled audit for the related incident-reporting workflow, and our SaaS & fintech practice for how we tailor this to data-heavy platforms.