---
title: "Significant Data Fiduciary Under the DPDP Act | dpdpr.in"
description: "Significant Data Fiduciary under the DPDP Act and Rule 13: who can be notified, and the extra duties such as a DPO, audits and impact assessments."
url: "https://dpdpr.in/guides/significant-data-fiduciary/"
canonical: "https://dpdpr.in/guides/significant-data-fiduciary/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Significant Data Fiduciary obligations

The Central Government may notify any Data Fiduciary, or a class of them, as a Significant Data Fiduciary ([section 10](https://dpdpr.in/act/section-10/)). It considers factors including the volume and sensitivity of personal data, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order.

## Extra duties

- **Data Protection Officer:** must represent the Significant Data Fiduciary, be based in India, be responsible to the Board of Directors or similar governing body, and be the point of contact for grievance redressal ([section 10](https://dpdpr.in/act/section-10/)).
- **Independent data auditor:** to carry out a data audit and evaluate compliance ([section 10](https://dpdpr.in/act/section-10/)).
- **Data Protection Impact Assessment and audit** once in every period of twelve months from notification, with a report of significant observations furnished to the Board ([rule 13](https://dpdpr.in/rules/rule-13/)).
- **Algorithmic due diligence:** verify that technical measures, including algorithmic software, are not likely to pose a risk to the rights of Data Principals ([rule 13](https://dpdpr.in/rules/rule-13/)).
- **Data localisation for specified data:** personal data specified by the Government, on the recommendation of a committee, must not be transferred outside India, along with its traffic data ([rule 13](https://dpdpr.in/rules/rule-13/)).

## Status

Section 10 and rule 13 come into force on 13 May 2027. We have not found any official notification naming a Significant Data Fiduciary. Startups and other notified Data Fiduciaries may be exempted from section 10 under [section 17](https://dpdpr.in/act/section-17/).