Significant Data Fiduciary: what changes if you are notified

Most obligations in the framework apply to every Data Fiduciary. This tier is different: it arrives by name.

How you become one

Section 10 lets the Central Government notify any Data Fiduciary or class as significant, on an assessment of factors the Act lists: the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. Until a notification names you or your class, the additional duties below do not attach; there is nothing to self certify into or out of.

What changes once notified

The Act requires three appointments and practices. A Data Protection Officer who represents you, is based in India, answers to your board of directors or equivalent, and is the contact point for grievance redressal. An independent data auditor who evaluates your compliance. And periodic Data Protection Impact Assessments and audits.

Rule 13 turns the periodic into a cycle: a DPIA and an audit once every twelve months from notification, with the person conducting them reporting significant observations to the Board. It adds due diligence that algorithmic software you use for processing does not risk Data Principal rights, and a localisation duty for any personal data the government specifies on a committee's recommendation, restricting transfer of that data and related traffic data outside India.

Why plan for it before it happens

If your data volumes are large or sensitive, the sensible posture is building as if notification is plausible: the DPIA muscle, the audit trail and the board level reporting take quarters to stand up, not weeks.

What to do

The SDF cycle is a conditional action in the company plan, clearly marked as applying only if notified. The official texts live at Rule 13 and in the Act's section 10.