Significant Data Fiduciaries

How an SDF is named

The Central Government may notify any Data Fiduciary or class as a Significant Data Fiduciary after assessing relevant factors. They include the volume and sensitivity of data, risk to people's rights, and impact on India's sovereignty and integrity. They also include risk to electoral democracy, security of the State and public order.

Sources: Act s.10(1)

The Data Protection Officer

An SDF must appoint a Data Protection Officer who represents it under the Act and is based in India. The DPO is responsible to its board of directors or similar governing body, and is the point of contact for grievance redressal.

Sources: Act s.10(2)(a)

Auditor, DPIA and audit

An SDF must appoint an independent data auditor to evaluate its compliance, and carry out periodic Data Protection Impact Assessments and audits. A DPIA describes people's rights and the purposes of processing, and assesses and manages the risk to those rights.

Rule 13 makes these yearly: a DPIA and an audit once in every twelve months from the date of notification. The person carrying them out must give the Board a report of the significant observations.

Sources: Act s.10(2)(b)Act s.10(2)(c)Rules r.13(1)Rules r.13(2)

Algorithms and data that stays in India

An SDF must use due diligence to check that its technical measures, including algorithmic software, are not likely to pose a risk to people's rights. It must also ensure that personal data the Government specifies, on a committee's recommendation, and its traffic data, are not transferred outside India.

Sources: Rules r.13(3)Rules r.13(4)

Penalty and exemption

Breaching the additional SDF obligations under section 10 can attract a penalty of up to Rs 150 crore. The Government may also notify classes of Fiduciaries, including startups, to whom section 10 does not apply.

Sources: Act Schedule item 4Act s.17(3)