Short answer: A Significant Data Fiduciary (SDF) is an app or company the Central Government notifies under s.10 based on factors such as the volume and sensitivity of data it processes. From 13 May 2027, SDFs must appoint a Data Protection Officer based in India and an independent data auditor, and under Rule 13 carry out a DPIA and audit every 12 months. No SDF had been notified as of 21 October 2026.
What is a Significant Data Fiduciary?
A Significant Data Fiduciary is any Data Fiduciary, or class of Data Fiduciaries, that the Central Government notifies as such under s.10 after assessing factors including the volume and sensitivity of personal data and the risks of its processing (s.2(z), s.10(1)).
How does an app become an SDF?
Only by notification. The Act and Rules set no numeric thresholds, such as user counts or revenue, and the assessment is carried out by a MeitY officer designated by the Secretary (s.10(1), Seventh Schedule item 3).
- No SDF notification had been found as of 21 October 2026.
- The SDF criteria have not been quantified, which is listed as an open question in our research.
- The Third Schedule user thresholds (for example 2 crore registered users for e-commerce) relate to data retention, not SDF status. See retention and erasure.
What extra duties does an SDF have?
An SDF must appoint a Data Protection Officer based in India, appoint an independent data auditor, conduct periodic Data Protection Impact Assessments and audits (s.10(2)), and under Rule 13 do both every 12 months, carry out algorithmic due diligence and observe any data localisation the Government specifies.
| Duty | Detail | Source |
|---|---|---|
| Data Protection Officer | Represents the SDF, based in India, responsible to the board of directors or similar governing body, grievance point of contact | s.10(2)(a) |
| Independent data auditor | Appointment of an independent data auditor | s.10(2) |
| DPIA and periodic audit | Periodic, plus other prescribed measures | s.10(2)(c) |
| Annual cycle | DPIA and audit once every 12 months from notification; report of significant observations furnished to the Board | Rule 13(1), (2) |
| Algorithmic due diligence | Verify that technical measures, including algorithmic software, for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data are not likely to pose a risk to users' rights | Rule 13(3) |
| Data localisation | Specified personal data, and the traffic data pertaining to its flow, not to be transferred outside India | Rule 13(4), (5) |
- Reported change: a Removal of Difficulties Order dated 5 October 2026 reportedly reworded "audit" in s.10(2)(c)(ii) to "data audit". Commentators (SCC Online, King Stubb & Kasiva) report that it adds no new duties. The primary Gazette text was not retrieved for this guide.
- No personal data had been specified under Rule 13(4) as of 21 October 2026. See cross-border transfers.
What is the penalty for breaching SDF duties?
Breach of the additional obligations of an SDF under s.10 carries a penalty of up to ₹150 crore (Schedule item 4). This sits alongside the general penalties, such as up to ₹250 crore for security failures. See the penalties page.
Has the SDF timeline changed?
Not in law. MeitY reportedly proposed at a stakeholder meeting on 23 January 2026 to shorten the 18-month window to 12 months, at least for large businesses or SDFs, and to enforce Rules 13(4) and 15 immediately (reported by S.S. Rana & Co. via Chambers). No amending Gazette notification had been found as of 21 October 2026, and the Rules as published still give 13 May 2027.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider whether your app processes data at a volume or sensitivity that could attract designation, and track MeitY notifications on the timeline.
- If designation is plausible, a common approach is to identify a candidate DPO based in India with a reporting line to the board.
- Consider scoping a DPIA now for high-risk processing, such as profiling, location data or large-scale tracking, even before any designation.
- Inventory algorithmic systems that touch personal data, such as recommendation or ranking models, for Rule 13(3) due diligence.
- Map where data is stored, so you can respond if specified data must be kept in India under Rule 13(4).
- Note that a DPO is not required for non-SDF apps, though they must still publish a contact person (s.8(9)).