What DPDP Regulators Expect From a Significant Data Fiduciary

A Significant Data Fiduciary (SDF) under India's Digital Personal Data Protection Act 2023 is a Data Fiduciary designated by the Central Government based on the volume and sensitivity of personal data it processes, the risk it poses to data principals, and its potential impact on India's sovereignty or national security. If designated, the obligations go well beyond the standard Data Fiduciary requirements: you must appoint a Data Protection Officer based in India, conduct annual Data Protection Impact Assessments, undergo regular independent data audits, and comply with data localisation requirements for specific categories of personal data.

The Central Government has not yet published a full list of designated SDFs as of mid-2026, but the criteria are clear enough that many SaaS companies processing large volumes of Indian user data can assess their own designation risk now and those that wait until designation arrives will be building under pressure.

Here is what SDF designation means operationally, how to assess whether your SaaS is at risk, and what to build in advance.

How the Central Government Decides Who Is an SDF

Section 10 of the DPDP Act 2023 gives the Central Government authority to designate any Data Fiduciary as a Significant Data Fiduciary based on an assessment of:

• The volume of personal data processed

• The sensitivity of the personal data processed

• The risk to the rights of Data Principals

• The potential impact on the sovereignty and integrity of India

• The risk to electoral democracy

• National security considerations

• Public order implications

No minimum volume threshold is specified in the Act itself. The criteria are intentionally broad, giving the government flexibility to designate based on any combination of factors which means a company processing a relatively smaller volume of highly sensitive data (health records, financial data, biometric data) could be designated alongside companies processing vast volumes of lower-sensitivity data.

According to ITIF's analysis of India's DPDP regulatory architecture, technology companies operating extensively in India are among the most likely candidates for SDF designation, particularly those processing personal data across financial services, health, and large-scale consumer platforms.

Companies that are uncertain about their designation risk should assess themselves against the criteria now rather than waiting for a government notification. The assessment is straightforward: how many Indian users do you have, what categories of data do you process about them, and does your platform touch sectors the government considers sensitive from a sovereignty or national security perspective?

The Five Additional Obligations SDFs Carry

Standard Data Fiduciary obligations, consent, rights fulfilment, breach notification, security safeguards, processor contracts, all continue to apply in full. SDF designation adds five obligations on top.

1. Data Protection Officer Based in India

An SDF must appoint a Data Protection Officer who is based in India and is a key managerial personnel or an equivalent senior representative of the Data Fiduciary.

Two things matter here beyond the headline requirement.

The DPO must be based in India, not a remote appointment from headquarters in the US, Singapore, or the UK. For SaaS companies without India-based operations, this requires either hiring a senior India-based compliance leader or restructuring how the function is organised.

The DPO must be a key managerial person or equivalent senior representative, not a mid-level compliance analyst. The intent is a sufficiently senior individual who can represent the company before the Data Protection Board and has genuine authority over compliance decisions internally.

Cyril Amarchand Mangaldas' DPDP practice notes highlight that the "key managerial personnel" requirement deliberately mirrors the Companies Act 2013 definition, linking the DPO standard to a recognised category of executive seniority in Indian corporate law, not a generic "senior" label.

2. Annual Data Protection Impact Assessments

SDFs must conduct an annual Data Protection Impact Assessment (DPIA) covering their processing activities. A DPIA is a structured evaluation of how personal data processing creates risk to Data Principals. What data is collected, why, where it flows, what could go wrong, and what mitigations are in place.

This is not a one-time exercise. Annual DPIAs mean a recurring assessment cycle that needs to be embedded into the organisation's compliance calendar, resourced, and executed by people with the technical and legal expertise to assess data flows accurately.

For SaaS companies that have already run DPIAs under GDPR Article 35, the structure is familiar. The DPDP DPIA is not identical, the Act's narrower legal basis framework and different rights structure mean the risk assessment criteria differ in some areas but the process discipline transfers. Building on an existing GDPR DPIA programme is more efficient than starting from zero.

3. Regular Independent Data Audits

SDFs are required to undergo regular independent audits of their compliance with the DPDP Act and Rules. The audits must be conducted by an independent auditor, not internal compliance teams and cover the full scope of DPDP obligations including consent architecture, security safeguards, data principal rights fulfilment, breach response capability, and processor oversight.

The frequency of audits is determined by the Central Government and has not been fully specified in the Rules notified to date. "Regular" in the context of similar frameworks typically means at least annually for core obligations.

Independent audits serve two functions: they create genuine accountability for compliance rather than self-assessment, and they produce documented evidence of the compliance programme's state at a point in time, exactly the kind of evidence the Data Protection Board looks for when assessing penalty levels after an incident.

Scrut's analysis of the DPDP Rules 2025 notes that the mandatory audit requirement for SDFs specifically addresses the gap between documented compliance programmes and operational reality, a gap that self-assessment processes consistently fail to close.

This independent audit requirement sits within the same discipline as the penetration testing and technical validation work that mature security programmes already run. Our guide on what a penetration test involves covers the technical validation layer, and the DPDP audit adds a compliance governance layer on top.

4. Data Localisation for Specified Categories

Under Rule 12 of the DPDP Rules 2025, SDFs face additional data localisation requirements for categories of personal data and related traffic data specified by the Central Government. These categories may be required to be stored and processed within India, regardless of the general cross-border transfer permission available to standard Data Fiduciaries.

The specific categories subject to localisation have not been exhaustively enumerated in the Rules as notified, and the Central Government retains authority to specify them through subsequent notifications. The framework exists; the full list of affected data types is still developing.

What is clear is the direction: SDFs processing sensitive personal data, financial, health, biometric are the most likely targets for localisation requirements, given the Act's emphasis on sovereignty and national security as designation criteria.

For SaaS companies that may be designated SDFs, this means cloud architecture decisions made today have compliance implications that could be mandated retroactively by designation and localisation notifications. Building India-region data residency capability into your cloud architecture now, even if it is not yet required, is significantly cheaper than redesigning it after a designation notification arrives.

Our guide on cross-border data transfers under India's DPDP rules covers how localisation interacts with the general transfer framework in detail.

5. Additional Obligations as Specified by the Central Government

Section 10 gives the Central Government authority to impose obligations on SDFs beyond the four listed above. This catch-all provision means the SDF obligation set is not closed. Further requirements can be added by notification without requiring amendment to the Act.

For compliance planning purposes, this means building a regulatory monitoring process into your SDF programme, not just building to the current known requirements.

Penalty for Failing SDF Obligations

Failure to fulfil Significant Data Fiduciary obligations under Section 10 carries a maximum penalty of ₹150 crore per incident under Schedule 1 of the Act. This is in addition to the standard Data Fiduciary penalties, the ₹250 crore for inadequate security safeguards and ₹200 crore for breach notification failure which continue to apply independently.

An SDF that experiences a breach resulting from inadequate security safeguards, fails to notify within the required window, and has not been conducting required annual DPIAs faces exposure across all three penalty tiers simultaneously.

The full penalty structure is covered in our piece on DPDP penalties and what a breach can cost your SaaS.

How to Assess Your SDF Designation Risk

Work through these questions for your SaaS:

Volume: How many Indian users does your product have? How much personal data do you hold per user, and how frequently is it processed? Platforms with tens of millions of Indian users, or processing high volumes of data per user, are in the higher-risk designation category.

Sensitivity: What categories of personal data does your product process for Indian users? Financial data, health records, biometric data, location data, and children's data are all more likely to attract SDF designation than generic profile data.

Sector: Does your SaaS operate in financial services, health technology, telecommunications, or any sector with existing regulatory sensitivity in India? Sector context increases designation risk independent of volume.

Infrastructure significance: Does your platform form part of critical digital infrastructure in India, payments, communications, essential services? Platforms where a breach or outage would have systemic effects are prime SDF candidates.

If your honest answers to these questions suggest designation is plausible rather than remote, building to SDF requirements now is the rational compliance posture. Designation is not preceded by a long runway for preparation, it arrives by government notification, after which the obligations are immediate.

Digisecuritas' DPDP Compliance Services include an SDF designation risk assessment as part of the initial gap assessment, helping SaaS companies understand their realistic designation likelihood and what pre-designation preparation makes sense for their specific data profile and scale.

Building for SDF Requirements Before Designation

The companies in the strongest position when an SDF designation arrives are those that treated designation as a planning assumption rather than a waiting game. Here is what pre-designation preparation looks like in practice.

Appoint or identify your India-based DPO candidate: Whether through a hire, a restructured role for an existing senior India-based leader, or a fractional arrangement with a qualified compliance professional, this decision takes time. It should not be the first thing resolved after a designation notification.

Build DPIA capability into your compliance cycle: Running your first annual DPIA under time pressure after designation is the most expensive way to meet the requirement. Integrating DPIA methodology into existing product launch and data use review processes now means the annual obligation is an incremental effort, not a project triggered by external pressure.

Commission an independent compliance audit: : Even before designation makes it mandatory, running an independent audit of your DPDP compliance programme produces the evidence base the Board looks for and identifies gaps before they become a regulatory conversation. Our vCISO services can provide the senior compliance leadership needed to commission and manage that audit without a full-time hire.

Assess India-region cloud architecture: If localisation requirements for your data categories are a realistic possibility, evaluate what India-region data residency would require from your AWS, Azure, or GCP architecture and whether that is feasible within your current infrastructure contracts and engineering capacity.

Document your current compliance state: An undocumented compliance programme is nearly as risky as no programme when a designation notification arrives. Every gap assessment, consent architecture decision, security control, and DPIA needs to be documented and evidenced before designation, not assembled in response to it.

Conclusion

SDF designation is the DPDP Act's way of applying proportionate scrutiny, higher obligations for the organisations whose data practices carry the highest consequence at scale. For SaaS companies that sit in the likely designation categories, treating it as someone else's problem until a government notification arrives is the most expensive compliance posture available.

The DPO appointment, annual DPIAs, independent audits, and localisation planning that SDF status requires are all buildable now. None of them require the designation to have occurred to start. And all of them are significantly cheaper to build methodically than to assemble under the timeline pressure that a designation notification creates.

Digisecuritas helps SaaS companies assess SDF designation risk, build the compliance programme SDF status requires, and prepare the evidence the Data Protection Board will look for during independent audits. Book a Discovery Call to understand where your designation risk sits and what pre-designation preparation makes sense for your business.