Significant Data Fiduciary: Does DPDP Apply to You?

Every organisation that decides why and how personal data is processed is a Data Fiduciary under India’s Digital Personal Data Protection Act. A smaller group will be named Significant Data Fiduciaries. That label brings extra duties, and it is worth understanding early whether it might apply to you.

The government decides who is a Significant Data Fiduciary, based on factors such as the volume and sensitivity of the data processed and the risk to people. You cannot simply opt out. This article explains the extra duties in general terms and how to get ready without overreacting.

1. Who is likely to be named

The Act allows the government to notify an organisation, or a class of organisations, as Significant Data Fiduciaries. The factors it can consider include how much personal data is processed, how sensitive it is, the risk of harm to people, and wider concerns such as public order and the security of the state.

In practice, companies that handle very large volumes of personal data or sensitive data are the obvious candidates. Large consumer platforms, financial services, health services and companies that process data about children often fall into this conversation. But the final list is the government’s decision, so check the current notifications rather than guessing.

If you think you might be close, behave as if you could be named. The extra duties build on good practice that is useful anyway, so the effort is rarely wasted.

Being named also changes how customers and partners see you. Larger clients may ask about your status in their due diligence, and investors may ask how you would cope with the extra duties. A clear, honest answer, backed by a plan, is better than an assumption either way.

2. The extra duties in plain terms

A Significant Data Fiduciary takes on duties on top of those every Data Fiduciary has. Check the Act and the Rules for the exact wording, but the main additions are usually described as follows.

• A Data Protection Officer based in India. This person represents the organisation on data protection, reports to the board or a similar body, and acts as the contact for people with questions or grievances.
• An independent data auditor. An external auditor reviews how the organisation complies with the Act.
• Data protection impact assessments. Regular assessments of the risks that processing creates for people, and how those risks are managed.
• Periodic audits and other measures. Further checks and safeguards that the government may set out in the Rules.

These duties change how governance works. Data protection stops being a side task for the legal team and becomes a standing function with a named leader, regular reviews and outside scrutiny.

3. How to prepare without overreacting

Preparation is mostly about structure and evidence. Start with a short gap review against the extra duties. Who would be your Data Protection Officer? Do you have a method for impact assessments? Could an independent auditor follow your records today?

Next, give the work a home. Many organisations set up a small privacy committee with members from legal, technology, security and the business. The committee owns the risk register for personal data, approves impact assessments and tracks actions. If you already run an information security management system under ISO 27001, you can often extend its meetings, risk methods and internal audits rather than building a parallel structure.

Impact assessments deserve care. A good assessment describes the processing, the risks to people, the safeguards and the decision taken. Keep the template short enough that teams will use it, and require it before a new high-risk product or feature goes live.

Finally, practise being audited. Run an internal review using the questions an independent auditor is likely to ask. Can you show your data inventory, your notices, your consent records, your vendor contracts and your breach plan? Gaps found internally are far cheaper to fix than gaps found by an external auditor.

Budget is the other practical question. An independent auditor, a Data Protection Officer and regular impact assessments all need time and money. Raising this early with leadership avoids a scramble later and lets you choose people and partners with care.

For a broader view of the basics every Data Fiduciary needs, read our DPDP Act readiness article. If you want to talk through whether the extra duties might reach your organisation, our DPDP compliance team is happy to help you think it through.