Significant Data Fiduciaries: Additional Obligations

Knowledge Resources › Significant Data Fiduciaries

Last updated: 6 August 2026

Under the Digital Personal Data Protection Act, 2023, most organisations that decide how and why personal data is processed are “Data Fiduciaries”. The Act also creates a category of “Significant Data Fiduciary” for organisations that the Central Government notifies as such — and these organisations carry additional obligations.

Who may be notified as a Significant Data Fiduciary

The Central Government may notify a Data Fiduciary, or a class of Data Fiduciaries, as a Significant Data Fiduciary based on an assessment of relevant factors, including:

• the volume and sensitivity of personal data processed;
• the risk to the rights of Data Principals;
• the potential impact on the sovereignty and integrity of India;
• the risk to electoral democracy;
• the security of the State; and
• public order.

The additional obligations

An organisation notified as a Significant Data Fiduciary must, in addition to the general obligations under the Act:

• Appoint a Data Protection Officer — who must be based in India, be responsible to the Board of Directors (or similar governing body), and act as the point of contact for the grievance redressal mechanism.
• Appoint an independent data auditor — to carry out a data audit and evaluate compliance with the Act.
• Undertake periodic reviews — including a periodic Data Protection Impact Assessment and a periodic audit, along with such other measures as may be prescribed.

Whether a particular organisation is a Significant Data Fiduciary depends on notification by the Central Government. Organisations that process personal data at scale, or whose processing carries heightened risk, should assess whether these additional obligations are likely to apply to them.