Significant data fiduciary

A significant data fiduciary is a data fiduciary, or a class of them, that the Central Government notifies under section 10 of the Digital Personal Data Protection Act, 2023 because of the volume or sensitivity of what it processes or the risk it poses. No company is a significant data fiduciary until it is notified as one.

Rule 13 of the Digital Personal Data Protection Rules, 2025 adds four duties: a data protection impact assessment and an audit once in every twelve months from notification; a report of their significant findings to the Board; due diligence that its algorithmic software poses no threat to the rights of data principals; and, for personal data specified on a committee's recommendation, processing under a restriction that the data and its traffic data are not transferred outside India. The twelve-month clock starts from notification, not from 13 May 2027. The position is stated as at 13 November 2025.