InfraVeritas360DPDPiqDPDP Insights › The law › Section 10 · Rule 13
Section 10 · Rule 13: Significant Data Fiduciaries
The government may notify organisations as Significant Data Fiduciaries based on the volume and sensitivity of data and the risk involved. They need a DPO based in India, an independent data auditor, and a yearly impact assessment and audit. None had been notified when this page was last reviewed.
What it means in your sector
- Central government: ministries and departments: No government body had been notified as a Significant Data Fiduciary when this page was last reviewed, though large public data holders are natural candidates.
- Public sector undertakings and utilities: Large consumer-facing PSUs are natural SDF candidates, though none had been notified when this page was last reviewed.
Questions where this section matters
- Do we need a DPO?
- Could we be a Significant Data Fiduciary?
- What should the board of directors ask management about DPDP?
- How do we put DPDP into the risk register?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.