Significant Data Fiduciary: 6 factors, no fixed threshold
By Abhijeet Singh · Primary sources verified by dpdprules.orgPublished · Last reviewed 5 min read
Jump to sourcesWhat is a Significant Data Fiduciary and is there a user or revenue threshold?
The short answer
A Significant Data Fiduciary is a Data Fiduciary or class the Central Government may notify under section 10 once it is in force. Section 10 prints no automatic user count, revenue figure or employee number. Instead, its open assessment includes 6 named factors: data volume and sensitivity, risk to Data Principal rights, potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State, and public order. The Government may consider other relevant factors too, so the list is not a self assessment formula. Section 10 commences on a computed 13 May 2027, interpretation until officially confirmed. No designation notification was located in this site's registry or timeline or among the 19 DPDP records in MeitY's 1,615 record library enumeration on 26 October 2026; the eGazette was not checked, so this is not a certified negative. A notified fiduciary would face additional obligations under section 10 and Rule 13.
Status as at 26 October 2026: no Significant Data Fiduciary designation was located on the checked surfaces, and section 10 is not in force. Its computed commencement date is 13 May 2027, interpretation until officially confirmed.
Section 10 is not in force. Once it commences, it creates an additional tier that attaches only after a Central Government notification. Because that tier arrives by notification rather than self classification, numbers from other parts of the Rules can be mistaken for SDF thresholds. This article owns that threshold question: it separates the 6 factors the Act names from the registered user counts the Third Schedule uses for a different purpose. The additional obligations of a Significant Data Fiduciary are covered in a separate guide.
How you become one: factors, not thresholds
Once it is in force, section 10(1) permits the Central Government to notify any Data Fiduciary or class as significant on the basis of an assessment of such relevant factors as it may determine. The list is open, not a closed scoring formula. It includes data volume and sensitivity, risk to Data Principal rights, potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State, and public order. The glossary entry for Significant Data Fiduciary carries the section 2(z) definition of the term with its citation.
The 6 named factors have no number attached. They specify no registered user count, revenue figure or employee headcount. That does not prevent the Government from considering a number as another relevant factor, because section 10(1) says "including" and leaves the assessment open. It does mean that no number printed in section 10 automatically moves an organisation into or out of the tier, and an organisation cannot self certify its status.
As at 26 October 2026, no notification designating a Data Fiduciary or class as significant was located in this site's source registry or timeline or among the 19 DPDP records in MeitY's 1,615 record library enumeration. The eGazette was not checked. This is a bounded account of the surfaces checked, not a certified negative. Section 10 is itself not in force, and its computed commencement date is 13 May 2027, interpretation until officially confirmed.
The thresholds you see quoted online, corrected
The figure of 50 lakh registered users does appear in the notified Rules, but not in section 10 and not as an SDF criterion in the Third Schedule. It comes from the Third Schedule, which supplies periods and purposes for Rule 8(1), not a significance test.
| The number | Where it actually appears | What it actually does | SDF trigger? |
|---|---|---|---|
| 2 crore registered users, ecommerce entity | Third Schedule, read with Rule 8(1) | For the listed purposes, supplies a 3 year period measured from the latest of the person's last approach for the purpose, exercise of rights, or commencement of the Rules. Account access and access to a qualifying virtual token are excluded purposes. | No |
| 50 lakh registered users, online gaming intermediary | Third Schedule, read with Rule 8(1) | Supplies the same 3 year period for the listed purposes, with the same 2 excluded purposes. | No |
| 2 crore registered users, social media intermediary | Third Schedule, read with Rule 8(1) | Supplies the same 3 year period for the listed purposes, with the same 2 excluded purposes. | No |
| A user, revenue or employee number in section 10 | None of the 6 named factors | Section 10 leaves the Government's assessment open but prints no number beside a named factor. | No automatic trigger |
If an organisation belongs to one of the 3 scheduled classes and meets its registered user threshold, Rule 8(1) and the corresponding Third Schedule purposes apply once Rule 8 is in force, subject to the legal retention exception printed in the rule. Rule 8(2) requires notice at least 48 hours before its period completes. Rule 8(1) also contains an unexplained "or" after the legal retention limb; this article does not resolve that wording. The Rule 8 guide examines the full mechanism. None of it creates SDF status.
What notification changes
Notification is the gate to additional duties, not a number an organisation crosses. In brief, section 10(2) covers an India based Data Protection Officer, an independent data auditor, and periodic Data Protection Impact Assessments, periodic data audits and other prescribed measures. Rule 13 supplies further detail. Read the separate guide to the additional obligations of a Significant Data Fiduciary for the full duty list, 12 month cycle, reporting, algorithmic due diligence and conditional transfer restriction.
An honest self assessment
The Act gives no self assessment that creates SDF status. As a practical planning exercise only, walk your data map against the 6 named factors:
- Volume and sensitivity. How much personal data do you process, and what about its nature could make exposure consequential?
- Risk to rights. Could the processing materially affect a Data Principal's rights?
- Sovereignty and integrity of India. Could the processing affect India's sovereignty or integrity?
- Electoral democracy. Could the processing create risk to electoral democracy?
- Security of the State. Does the processing create a distinct State security risk?
- Public order. Could the processing affect public order?
Several yes answers do not make an organisation an SDF. Only a Central Government notification can do that. They may make early preparation sensible, but any preparation before notification is a recommendation and not a current section 10 or Rule 13 duty.
What to do
The SDF cycle is a conditional action in the company plan, marked as applying only if notified. The official texts live at section 10, Rule 13 and the Third Schedule. If a notification is located, the timeline will record it with the primary source after verification.
Section 10, official text →Rule 13, official text →Additional obligations of an SDF →