{"id":10038,"date":"2026-08-17T14:56:35","date_gmt":"2026-08-17T14:56:35","guid":{"rendered":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/"},"modified":"2026-08-17T14:56:35","modified_gmt":"2026-08-17T14:56:35","slug":"significant-data-fiduciary-dpdp-act","status":"publish","type":"post","link":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/","title":{"rendered":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most DPDP obligations apply to every Data Fiduciary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Section 10 creates a heavier tier: the <strong>Significant Data Fiduciary (SDF)<\/strong> \u2014 and if your organisation is notified into it, your compliance programme roughly doubles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is what \u00a710 actually says, who is likely to be covered, and what an SDF has to build.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">Who Becomes a Significant Data Fiduciary?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You do not self-declare as an SDF. The Central Government notifies a Data Fiduciary, or a class of Data Fiduciaries, as significant \u2014 based on an assessment of factors the Act lists:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>The volume and sensitivity of personal data processed<\/li>\n\n\n<li>The risk to the rights of Data Principals<\/li>\n\n\n<li>The potential impact on the sovereignty and integrity of India<\/li>\n\n\n<li>Risk to electoral democracy<\/li>\n\n\n<li>Security of the State and public order<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In practice: large consumer platforms, BFSI, healthcare, telecom, and any business processing sensitive data at scale should plan as if notification is a matter of when, not if. Our industry guides for <a href=\"\/blog\/dpdp-compliance-for-bfsi\">BFSI<\/a> and <a href=\"\/blog\/dpdp-compliance-for-hospitals\">hospitals<\/a> cover the sector angles.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">The Four Extra Obligations of an SDF<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. A Data Protection Officer, Based in India<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An SDF must appoint a DPO who represents it under the Act, is based in India, is responsible to the board of directors (or equivalent governing body), and acts as the point of contact for grievance redressal under <a href=\"https:\/\/protectcomply.com\/dpdp-act\/section-13\">\u00a713<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What that job looks like day to day: <a href=\"\/blog\/why-dpos-choose-protectcomply\">why DPOs choose ProtectComply<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. An Independent Data Auditor<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SDFs must appoint an independent data auditor to evaluate compliance with the Act. That means your evidence has to survive someone whose job is to find the gaps \u2014 see our <a href=\"\/blog\/dpdp-compliance-step-by-step\">DPDP audit guide<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Periodic Data Protection Impact Assessments<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DPIAs stop being optional good practice and become a recurring statutory exercise. Full guide: <a href=\"\/blog\/dpia-under-dpdp-act\">DPIA under the DPDP Act \u2014 who must do one and how<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Periodic Audits and Other Prescribed Measures<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Beyond the DPIA, \u00a710 requires periodic audit and leaves room for further measures to be prescribed under the Rules \u2014 which is why SDF programmes need machinery, not one-time projects. The phasing of these obligations follows the <a href=\"\/blog\/dpdp-rules-2025-timeline\">DPDP Rules 2025 timeline<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\">\n\n\n\n<h2 class=\"wp-block-heading\">What to Prepare Before You Are Notified<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A current <a href=\"\/blog\/records-of-processing-activities-ropa\">RoPA<\/a> \u2014 every SDF obligation assumes you know what you process and why<\/li>\n\n\n<li>A named DPO candidate and reporting line to the board<\/li>\n\n\n<li>A repeatable DPIA method, not a one-off document<\/li>\n\n\n<li>Audit-ready evidence generated continuously, not reconstructed annually<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ProtectComply maps each of these to a workflow \u2014 see <a href=\"\/blog\/protectcomply-dpdp-act-section-mapping\">how ProtectComply maps every DPDP Act section to a workflow<\/a>, or start with a <a href=\"\/blog\/dpdp-free-assessment-platform\">free readiness assessment<\/a>.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare Most DPDP obligations apply to every Data Fiduciary. Section 10 creates a heavier tier:\u2026<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-10038","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog<\/title>\n<meta name=\"description\" content=\"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog\" \/>\n<meta property=\"og:description\" content=\"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/\" \/>\n<meta property=\"og:site_name\" content=\"ProtectComply Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-17T14:56:35+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare\",\"datePublished\":\"2026-08-17T14:56:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/\"},\"wordCount\":439,\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/\",\"url\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/\",\"name\":\"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-08-17T14:56:35+00:00\",\"author\":{\"@id\":\"\"},\"description\":\"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/significant-data-fiduciary-dpdp-act\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/\",\"name\":\"ProtectComply Blog\",\"description\":\"Compliance, decoded.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/protectcomply.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog","description":"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/","og_locale":"en_US","og_type":"article","og_title":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog","og_description":"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.","og_url":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/","og_site_name":"ProtectComply Blog","article_published_time":"2026-08-17T14:56:35+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/#article","isPartOf":{"@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/"},"author":{"name":"","@id":""},"headline":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare","datePublished":"2026-08-17T14:56:35+00:00","mainEntityOfPage":{"@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/"},"wordCount":439,"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/","url":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/","name":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare - ProtectComply Blog","isPartOf":{"@id":"https:\/\/protectcomply.com\/blog\/#website"},"datePublished":"2026-08-17T14:56:35+00:00","author":{"@id":""},"description":"What Section 10 of the DPDP Act requires of Significant Data Fiduciaries: an India-based DPO, an independent data auditor, periodic DPIAs and audits - and how to prepare before you are notified.","breadcrumb":{"@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/protectcomply.com\/blog\/significant-data-fiduciary-dpdp-act\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/protectcomply.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Significant Data Fiduciary Under Section 10 of the DPDP Act: Obligations, Triggers, and What to Prepare"}]},{"@type":"WebSite","@id":"https:\/\/protectcomply.com\/blog\/#website","url":"https:\/\/protectcomply.com\/blog\/","name":"ProtectComply Blog","description":"Compliance, decoded.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/protectcomply.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/posts\/10038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/comments?post=10038"}],"version-history":[{"count":0,"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/posts\/10038\/revisions"}],"wp:attachment":[{"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/media?parent=10038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/categories?post=10038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/protectcomply.com\/blog\/wp-json\/wp\/v2\/tags?post=10038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}