What makes us a Significant Data Fiduciary under the DPDP Act?
An entity is designated a Significant Data Fiduciary (SDF) under the DPDP Act based on criteria notified by the Central Government. These criteria typically consider the volume and sensitivity of personal data processed, the risk of harm to Data Principals, the potential impact on India's sovereignty and security, and the need to safeguard public order. This designation imposes enhanced obligations to ensure robust data protection and accountability.
Being designated an SDF triggers several enhanced compliance obligations beyond those of a regular Data Fiduciary. These include appointing a Data Protection Officer (DPO) with specific qualifications and responsibilities, conducting Data Protection Impact Assessments (DPIAs) for certain processing activities, and undertaking periodic data audits. These measures aim to mitigate the higher risks associated with large-scale or sensitive data processing, requiring significant investment in governance frameworks and technical controls.
The specific thresholds and criteria for SDF designation are not fixed within the Act itself but are to be prescribed by the Central Government through rules. This means the designation is dynamic and depends on future notifications, making proactive risk assessment crucial for organisations handling substantial personal data. Entities should continuously evaluate their data processing activities against potential government criteria, such as the scale of processing, the nature of data (e.g., health, financial), and the potential for adverse impact, to anticipate and prepare for potential SDF obligations.
Sources
- The Digital Personal Data Protection Act, 2023, Section 10