Significant Data Fiduciary(SDF)

Legal basis

DPDP Act 2023, section 10; DPDP Rules 2025, rule 13

How you become one

Central Government notification, individually or by class

Officer

Data Protection Officer based in India, responsible to the board

Assessment cycle

DPIA and audit once every 12 months

Report to

Data Protection Board of India (significant observations)

Maximum penalty for SDF duties

Up to 150 crore rupees

Applies from

13 May 2027 on the current schedule

SDF status turns data protection from a policy document into an audited, board-level programme with a named officer in India and a yearly independent check. The cost of being unprepared is high: the Act's schedule allows penalties of up to 150 crore rupees for breaching the additional SDF obligations, on top of up to 250 crore rupees for failing to take reasonable security safeguards. For the vendors that serve such businesses — BSPs, chatbot platforms, CRMs — an SDF customer brings audit rights, DPIA questionnaires and data-location questions into every contract.

1. 1

   Notification

   The Central Government notifies a business, or a class of businesses, as an SDF after weighing the section 10 factors. Watch the Gazette and MeitY notices rather than guessing from size alone.

2. 2

   Appoint a Data Protection Officer in India

   Name an individual DPO, based in India and responsible to the board or equivalent governing body, and publish them as the contact for questions and grievances about personal data.

3. 3

   Appoint an independent data auditor

   Engage an auditor independent of the business to evaluate compliance with the Act, including how processors such as the BSP and AI vendors handle data.

4. 4

   Run the DPIA and audit every 12 months

   Assess risks to people's rights across processing activities — WhatsApp messaging, chatbots, analytics — and have the assessor send a report of significant observations to the Data Protection Board.

5. 5

   Check algorithms and data location

   Do due diligence that algorithmic software handling personal data, such as chat summarisers or scoring models, is not likely to risk people's rights, and keep any data the government specifies inside India.

• Assuming a size threshold decides it

  The Act publishes factors, not a number. Track notifications and keep a readiness plan, rather than waiting to cross a threshold that does not exist.

• Leaving messaging vendors out of the DPIA

  Chat transcripts, OTP logs and AI summaries held by a BSP or bot vendor are part of your processing. Include every processor in the assessment and in the audit's sample.

• Appointing a DPO in name only

  The DPO must be based in India, answer to the board and handle grievances. A title given to an overseas group officer, or to someone without authority, does not meet the duty.

• Ignoring algorithmic due diligence

  Rule 13 reaches software that processes personal data, so a chatbot, a chat summariser or a lead-scoring model is in scope. Document how each was tested for risk to people's rights.

• Keep one register of every system and vendor that touches WhatsApp data; it is the backbone of both the DPIA and the audit.
• Put audit and data-location clauses into BSP and AI vendor contracts before a notification forces renegotiation.
• Run a DPIA before major changes, such as launching a new chatbot, not only on the yearly date.
• Brief the board on the DPO's role early, since the officer reports to it.

How does a business become a significant data fiduciary?

Only by Central Government notification, issued for a business or a class of businesses. The government weighs data volume and sensitivity, risk to people's rights, and impacts on sovereignty, elections, State security and public order.

What extra duties does a significant data fiduciary have?

An India-based Data Protection Officer, an independent data auditor, and a DPIA and audit every 12 months. Rule 13 adds algorithmic due diligence, a report to the Data Protection Board and possible data localisation.

When do significant data fiduciary obligations start?

On the current schedule of the DPDP Rules 2025, from 13 May 2027. Proposals to bring the SDF duties forward have been discussed, so check MeitY notifications before relying on the date.

Is a WhatsApp BSP a significant data fiduciary?

Not for its clients' chats, normally: it processes them as a data processor on the brand's instructions. The brand carries any SDF duties and must include the BSP in its assessments and audits.

What is the difference between a data fiduciary and a significant data fiduciary?

Every business that decides how personal data is used is a data fiduciary with baseline duties. A significant data fiduciary is one the government has notified for extra duties on top of those.