Who is a Significant Data Fiduciary — and what changes if you are designated

Every DPDPA readiness conversation reaches this question within about twenty minutes, and it is almost always asked as though a threshold exists. It does not. Significant Data Fiduciary status is a designation by the Central Government, applied on stated criteria but at its discretion.

Which means the question "are we one?" has no reliable answer today. The better question is: what would it cost us to be treated as one, and how much of that should we do regardless?

For most of our larger clients the answer to the second half is "most of it."

What the criteria actually say#

The Act allows the Central Government to notify any Data Fiduciary or class of fiduciaries as significant, having regard to:

• The volume and sensitivity of personal data processed
• Risk to the rights of data principals
• Potential impact on the sovereignty and integrity of India
• Risk to electoral democracy
• Security of the State
• Public order

Read that list carefully. Only the first is quantitative, and even it has no stated number. The remaining five are policy judgements about the consequence of your processing, not measurements of it.

That structure is deliberate. It lets the government designate a small but systemically important platform while leaving a large but low-consequence one alone — and it means no amount of internal analysis produces certainty.

The three additional duties#

An India-based Data Protection Officer, accountable to the board

Not a nominated contact. An appointed officer, resident in India, representing the Data Fiduciary, whose contact details are published, and who is accountable to the board or a similar governing body.

Three parts of that sentence carry weight:

India-based. A group DPO sitting in London does not satisfy it. If your parent has appointed a global DPO, you need a separate Indian appointment or a locally resident individual formally holding the Indian role.

Accountable to the board. This is the reporting line, and it is the element that takes months rather than weeks — because it is a political change, not a documentation one. A DPO reporting to the General Counsel who reports to the CEO does not satisfy the requirement, and softening findings on the way up is exactly the failure mode the provision exists to prevent.

Published. The contact details go in your privacy notice and are registered with the relevant authority. That makes the appointment externally verifiable, which is why it cannot be a title held informally.

The role also cannot sit comfortably with the CISO or General Counsel. Both make or defend processing decisions the DPO must review, which is the conflict supervisory authorities specifically flag. We have written separately on what DPO independence actually requires.

An independent data auditor

Someone outside the programme, evaluating whether it works. Organisations that have never commissioned an independent privacy audit consistently underestimate the evidence this requires, because internal reviews tend to test whether documents exist rather than whether controls operate.

The distinction in practice: an internal review confirms a retention schedule is approved and current. An independent auditor asks for proof that data past its retention period has actually been deleted — including in analytics copies, in backups, and at processors — and will not accept the schedule as evidence of the outcome.

Budget for the audit and, more importantly, for the remediation the first one produces. A first independent privacy audit at a previously unaudited organisation typically generates a dozen or more findings, several of them substantive.

Periodic DPIAs and audits

Not one impact assessment for the flagship product. A standing methodology, applied on a defined cadence to processing that warrants it, with results that go somewhere and change something.

The operational test we apply: can you produce, for any high-risk processing activity, a completed assessment with a named author, a documented residual risk, and an identified executive who accepted that risk? If the answer requires a search, the process is not operating.

What it costs, relative to doing it well anyway#

This is the part that reframes the decision for most boards.

A well-run non-designated DPDPA programme already needs a data inventory, a consent architecture, rights fulfilment, retention enforcement, processor governance, breach response and some form of impact assessment. Those are the expensive components, and they are required either way.

The SDF-specific additions are the DPO appointment, the independent audit, and the formalisation of an assessment cadence you should have anyway. Against a properly built baseline, the marginal cost is roughly 15 to 20 per cent — not double, which is what teams tend to assume.

The asymmetry matters. Building for designation and not being designated wastes an estimated 15–20% of a programme cost. Being designated without having built for it means retrofitting a statutory board-level reporting line and an audit trail under a deadline you did not set — which is considerably more expensive, and considerably more disruptive politically.

Sequencing, if you decide to prepare#

What designation does not change#

Worth stating plainly, because teams assume the list is longer than it is.

Designation does not alter the substantive obligations that apply to every Data Fiduciary. Notice and consent requirements are identical. The rights of data principals are identical. Purpose and storage limitation are identical. Security safeguards are assessed on the same "reasonable" standard, and the breach notification duty is the same duty with the same absence of a materiality threshold.

Nor does designation introduce data localisation. Cross-border transfer remains governed by the same permissive default — permitted to any country not restricted by notification — with sectoral rules from the RBI, IRDAI and others continuing to apply independently of DPDPA status.

And it does not change the penalty structure. The ₹250 crore ceiling for failing to take reasonable security safeguards applies to every fiduciary; designation does not raise it.

What designation changes is the assurance layer: who watches the programme, who they answer to, and how often it is independently examined. That framing helps in a board conversation, because it separates "are we compliant?" — which is already the question — from "can we prove it to a standard someone else sets?"

The question to take to your board#

Not "are we a Significant Data Fiduciary?" — nobody can answer that yet.

Ask instead: if we were designated tomorrow, how long would it take us to comply, and what would that period look like?

If the answer is "we would need to establish a board-level reporting line, appoint and onboard a DPO, and commission an audit of a programme with no operating history," that is a nine-to-twelve month recovery under external pressure.

If the answer is "we already have the charter, the reporting line and the assessment cadence; we would appoint and commission," that is a matter of weeks.

The 15–20% buys the difference between those two positions. For any organisation processing consumer personal data at national scale, that has generally looked like a reasonable price.

Our Virtual Data Protection Officer service provides the statutory appointment with the charter, independence protections and board cadence built in, and the DPDPA framework page sets out the full obligation set including the Significant Data Fiduciary duties.