---
title: "DPDP Rules 2025, Rule 13: Significant Data Fiduciary Duties"
description: "Rule 13 of the DPDP Rules 2025 (Additional obligations of Significant Data Fiduciary): the official text, a plain-English summary and when it applies."
url: "https://dpdpr.in/rules/rule-13/"
canonical: "https://dpdpr.in/rules/rule-13/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Rule 13. Additional obligations of Significant Data Fiduciary

DPDP Rules, 2025 · G.S.R. 846(E)

## In simple words

Significant Data Fiduciaries must do a Data Protection Impact Assessment and an audit every twelve months, report key findings to the Board, check that their algorithms do not risk users' rights, and keep certain data in India if the Government specifies it.

- **What this means for you**: Large platforms must regularly check their risks to your rights.

- **What this means for businesses**: If notified as a Significant Data Fiduciary, plan yearly DPIAs and audits.

- **Everyday example**: A large e-commerce company notified as significant files a report of key DPIA findings with the Board.

## Who it applies to

Significant Data Fiduciaries.

## Related sections and Schedules

- [Section 10. Additional obligations of Significant Data Fiduciary](https://dpdpr.in/act/section-10/)

Official text as notified

Source: [MeitY copy of the Gazette, page 29](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=29). Printed dashes are shown as colons; the wording is unchanged.

(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder.

(2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit.

(3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals.

(4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India.

(5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Department of the Central Government.

**Corrigendum.** [G.S.R. 892(E) dated 10 December 2025](https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf) corrects this text as notified:

- rule 13(5): for “Department of the Central Government” read “Departments of the Central Government”

## When this takes effect

- Whole rule **Starts 13 May 2027** 191 days to go

Source: [G.S.R. 843(E)](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf) and [rule 1](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). [All deadlines](https://dpdpr.in/deadlines/)