What Is an SDF?
LawA Significant Data Fiduciary is a Data Fiduciary the Central Government notifies as such under Section 10, based on an assessment of risk that goes beyond what applies to Data Fiduciaries generally. Every SDF is a Data Fiduciary; not every Data Fiduciary is an SDF — the distinction is about scale and risk, not about being a "more official" or "more legitimate" category of business.
Who May Qualify
LawSection 10 sets out the factors the government considers when notifying an entity or class of entities as an SDF: the volume and sensitivity of personal data processed, the risk of harm to Data Principals' rights, the potential impact on the sovereignty and integrity of India, risk to electoral democracy, and considerations of security of the State and public order. In practice, this points toward large-scale consumer platforms, entities processing significant volumes of sensitive data (health, financial), and businesses whose data holdings are large enough that a failure would have broad-reaching consequences.
Criteria, in Practice
Because notification is government-driven rather than self-assessed, there's no fixed public threshold (like a specific user count) that automatically triggers SDF status the way the Third Schedule's specific retention thresholds work in Chapter 08. Businesses operating at genuinely large scale, or in categories the government is likely to prioritise (large platforms, entities processing significant health or financial data), should treat SDF classification as a realistic possibility worth planning for, rather than something to react to only once notified.
Additional Obligations
LawOnce notified, an SDF carries obligations beyond those of an ordinary Data Fiduciary:
| Obligation | What it requires |
|---|---|
| Data Protection Officer | An India-based DPO who reports to the Fiduciary's board and serves as the point of contact for grievance redressal |
| Independent Data Auditor | Periodic audits of compliance, carried out by an independent auditor |
| DPIA | Periodic Data Protection Impact Assessments — covered in full in Chapter 14 |
| Cross-border transfer restrictions | Compliance with any government-notified limits on transferring specified categories of personal data outside India (DPDP Rules 13(4), 15) |
Data Protection Officer
LawUnlike GDPR, where a DPO requirement can apply well beyond the largest organisations, DPDP reserves this specifically for SDFs — a deliberate scope-narrowing choice. The DPO's reporting line to the board (rather than to a lower level of management) is itself a meaningful structural requirement, intended to give the role genuine organisational standing rather than being buried within a single business function.
Independent Auditor
The audit requirement is explicitly about independence — an internal compliance review, however thorough, doesn't substitute for an auditor genuinely independent of the function being audited. This mirrors financial-audit norms more than a typical internal security review.
Risk Assessment and DPIA
Covered in full in Chapter 14 — in short, a structured assessment of the risk a given processing activity poses to Data Principals' rights, conducted periodically and reported alongside the compliance audit above.
Cross-Border Transfer Restrictions
LawSDFs must comply with any restrictions the Central Government notifies on transferring specified categories of personal data outside India, under Rules 13(4) and 15 of the DPDP Rules. In January 2026, MeitY floated a proposal to bring this specific SDF obligation into force ahead of the Act's general Stage 3 timeline (see Chapter 18) — worth monitoring closely if your organisation is a plausible SDF candidate, since this is one of the more actively evolving parts of the Act's implementation.
Governance Implications
PracticeSDF obligations are substantial enough that discovering you've been notified without any prior preparation is a genuinely difficult position to be in — an India-based DPO, an independent auditor relationship, and a DPIA process all take real time to stand up properly. Large-scale businesses in sensitive-data categories are better served treating this chapter as forward planning than as a wait-and-see obligation.