What is a Significant Data Fiduciary under the DPDP Act?
A Significant Data Fiduciary is a Data Fiduciary, or a class of them, notified as such by the Central Government based on factors including the volume and sensitivity of personal data processed, the risk to data principals, and potential effects on the sovereignty and integrity of India, electoral democracy, security of the State and public order. The classification brings additional obligations: appointing a Data Protection Officer based in India, appointing an independent data auditor, and carrying out Data Protection Impact Assessments and periodic audits.
The classification is the gateway to the heaviest duties in the Act, so determining and recording your status is a compliance step in itself. An organisation that has never made the determination has no answer if asked why it did not appoint a DPO.
Treat the determination as a documented decision with named owners and a date, and revisit it when your processing changes materially.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Jupinder Bedi — Jupinder writes on data protection practice at ProtectComply, with a focus on how obligations translate into system behaviour.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →