Amended on 6 October 2026. In sub-section (2), clause (c), sub-clause (ii), “periodic audit” now reads “periodic data audit”. Source: S.O. 5458(E), the Removal of Difficulties Order, 2026. See the official text.
In simple words
The Government can name some companies, or classes of companies, as Significant Data Fiduciaries. It looks at things like how much and how sensitive the data is, and risk to people or the country. These companies have extra duties: a Data Protection Officer in India, an independent data auditor, and regular impact assessments and audits.
- What this means for you
- Large or high-risk companies must meet stricter standards for your data.
- What this means for businesses
- Check whether you have been notified. If so, plan the DPO, audit and DPIA work in Rule 13.
- Everyday example
- If a very large social media platform is notified, it must appoint a Data Protection Officer based in India.
Who it applies to
Data Fiduciaries notified as Significant Data Fiduciaries by the Central Government.
Related Rules
- Rule 13. Additional obligations of Significant Data Fiduciary From 13 May 2027
Related sections
Official textas notified
Source: MeitY copy of the Gazette (CG-DL-E-12082023-248045), page 8. Printed dashes are shown as colons; the wording is unchanged. Later amendments are shown in place and marked.
(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including:
(a) the volume and sensitivity of personal data processed;
(b) risk to the rights of Data Principal;
(c) potential impact on the sovereignty and integrity of India;
(d) risk to electoral democracy;
(e) security of the State; and
(f) public order.
(2) The Significant Data Fiduciary shall:
(a) appoint a Data Protection Officer who shall:
(i) represent the Significant Data Fiduciary under the provisions of this Act;
(ii) be based in India;
(iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
(b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
(c) undertake the following other measures, namely:
(i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
(ii) periodic data audit; and
Amended. In sub-section (2), clause (c), sub-clause (ii), the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E) dated 5 October 2026, Gazette of India Extraordinary, Part II, Section 3(ii), No. 5248, 6 October 2026) substituted “periodic data audit” for “periodic audit”. Official order. As originally notified: (ii) periodic audit; and
(iii) such other measures, consistent with the provisions of this Act, as may be prescribed.