What a Significant Data Fiduciary designation would change

A growing customer base does not automatically make a company a Significant Data Fiduciary. Under DPDP, designation depends on Government notification. The practical task for a larger or higher-risk organisation is to understand the additional requirements and prepare for them without presenting an unverified designation as fact.

Section 10 sets out the notification power and additional obligations. Rule 13 adds operational detail. As of 22 October 2026, these substantive provisions are scheduled for May 2027 under the commencement notification. Any claim that a particular company has been designated needs the actual notification.

Understand the factors, not an invented threshold

The Act identifies factors including the volume and sensitivity of data, risks to individual rights, potential effects on sovereignty and integrity, electoral democracy, state security and public order. It does not give one universal revenue, employee or customer-count threshold that automatically creates SDF status.

A company can use those factors to inform readiness discussions. For example, a hypothetical platform processing large volumes of children’s learning records may have different risks from a small catalogue site. That comparison is useful for preparation, but it does not substitute for the Government’s designation decision.

Keep monitoring responsibility with a named owner. A notification may concern an individual fiduciary or a class. The business needs to understand whether the wording covers its actual activity and from when relevant obligations arise.

The DPO must have a real governance position

An SDF’s DPO must be based in India, represent the fiduciary under the Act, be responsible to its board or similar governing body, and serve as the contact for the grievance mechanism. This is more specific than adding “DPO” to an employee’s email signature.

Prepare a role description, reporting route, access to information and escalation authority. Consider how the person will obtain evidence from product, security, operations and vendors. The Act does not make an ineffective reporting structure useful merely because the job title is correct.

Ordinary fiduciaries still need appropriate contact and grievance arrangements under section 8, but the SDF-specific DPO requirement should not be described as universal for every shop or startup.

Separate the auditor from the activity being assessed

Section 10 requires an independent data auditor to evaluate compliance. The October 2026 Removal of Difficulties Order also corrected the periodic-audit wording to specify data audit. This clarification did not bring section 10 into force early or replace the need for a proper assessment.

The audit should be able to examine evidence across the processing lifecycle. A security certificate or penetration test may contribute evidence but does not automatically cover notices, grounds, rights, retention, children or vendor accountability. Define the scope and independence arrangements before selecting an assessor.

Plan the recurring assessment cycle

Rule 13(1) and (2) require a DPIA and audit once in each twelve-month period from the relevant designation or inclusion in a notified class. It also requires significant observations to be reported to the Board by the person conducting the assessment and audit.

Build a calendar tied to the actual designation date, with enough time for evidence collection and remediation. Do not assume that a financial-year audit automatically satisfies the period. The company should know which workflows, systems and changes the assessment covers.

For a hypothetical large marketplace, the first preparation exercise might focus on seller verification, customer profiling and fraud controls. Each has different data, purposes and individual consequences. A single generic risk score would hide those differences.

Examine algorithms and specified data flows

Rule 13(3) requires due diligence concerning technical measures, including algorithmic software, so they are not likely to risk Data Principal rights. Map the systems that make or support consequential decisions and identify the evidence needed to assess them.

The rule also provides for restrictions on transfer outside India of Government-specified personal data and related traffic data, based on committee recommendations. This is a conditional mechanism, not a current blanket localisation statement for every SDF dataset. Check the actual specification and other applicable law before changing architecture.

The useful preparation package contains a notification-monitoring owner, a credible DPO role, an independent audit plan, a recurring assessment cycle and a map of consequential processing. It should make the organisation ready to respond to a designation while keeping its public statements strictly tied to verified official instruments.