Chapter 11: Data Fiduciaries & SDFs

Obligations and compliance requirements

chapter · 2 min read · Updated 14-Feb-2026 · 11 of 14

Executive Summary

•Every Data Fiduciary has baseline duties. Organizations notified as Significant Data Fiduciaries have additional governance, assessment, audit, and due-diligence obligations.

•BASELINE (All Fiduciaries): (1) Security Safeguards to prevent breaches. (2) Responsible for any Data Processor you hire. (3) Must erase data when purpose is met.
•SDF ONLY: Appoint an India-based Data Protection Officer and independent auditor, undertake the assessments and audits required by the Act and rule 13, and address the additional technical due-diligence and notified data-localization requirements.

•Higher Standards: The biggest players have to prove they are safe through independent audits, but EVERY company must keep your data secure.

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A fiduciary documents security safeguards, processor oversight, retention controls, and—where applicable—DPO, audit, and DPIA responsibilities.

Incorrect

×An organization assumes its processor is responsible for compliance and has no evidence that security controls are operating.

Specifies obligations for Data Fiduciaries and additional requirements for Significant Data Fiduciaries.

General obligations: Requirements for all Data Fiduciaries
SDF criteria: Thresholds for Significant Data Fiduciary designation
Additional SDF obligations: Data Protection Impact Assessment, Data Protection Officer, audits
Accountability measures: Documentation and compliance demonstration

SDF status follows a Central Government notification based on the factors in section 10; it should not be inferred from organization size alone.

Primary sources: sections 8 and 10 of the DPDP Act and rules 6 and 13 of the DPDP Rules.