Significant Data Fiduciary under DPDP Act, 2023

Introduction

Not all data-handling organizations are treated equally.

Some organizations process large volumes of data, sensitive data, or engage in activities that may pose higher risks to individuals.

Such entities may be classified as Significant Data Fiduciaries (SDFs) under the DPDP Act, 2023.

Who Designates an SDF?

The Central Government has the authority to notify a Data Fiduciary as “Significant” based on prescribed criteria.

The designation is not automatic — it is based on risk assessment.

Factors Considered for Classification

While the Act provides flexibility, the government may consider:

• Volume of personal data processed

• Sensitivity of data

• Risk to rights of individuals

• Impact on sovereignty and security

• Use of new technologies

• Risk of harm to Data Principals

Additional Compliance Requirements for SDFs

Once classified as an SDF, the entity must comply with stricter obligations, including:

1️⃣ Appointment of a Data Protection Officer (DPO)

• Must be based in India

• Acts as the point of contact for compliance

• Handles grievance redressal

2️⃣ Appointment of an Independent Data Auditor

• To evaluate compliance with the Act

• Ensures accountability

3️⃣ Periodic Data Protection Impact Assessments (DPIA)

• To assess risks before large-scale processing

• Especially for high-risk activities

4️⃣ Enhanced Record-Keeping & Monitoring

Why SDF Classification Matters

SDFs typically include:

• Large tech platforms

• Financial institutions

• Social media companies

• High-volume data processors

The classification ensures:

• Greater accountability

• Stronger oversight

• Reduced risk of misuse

• Higher protection standards

Legal Foundation (Optional Reference Section)

Although no major DPDP-specific case law exists yet on SDF classification, the constitutional foundation comes from:

🔹 Justice K.S. Puttaswamy v. Union of India

The Court recognized:

• Informational privacy as a fundamental right

• Need for proportional safeguards in data processing

This principle supports stricter compliance for high-risk data handlers.

Conclusion

The concept of Significant Data Fiduciary ensures that organizations handling large-scale or high-risk data adopt enhanced safeguards.

It reflects the DPDP Act’s risk-based regulatory approach.