Significant Data Fiduciaries Under the DPDP Act: DPOs, Annual DPIAs, Algorithm Audits and Data Localisation Before May 2027

Here is a fact that most DPDP commentary gets wrong: as of the date of this article, not a single company in India is a Significant Data Fiduciary. The Central Government has issued no notification under Section 10 of the Digital Personal Data Protection Act, 2023 designating any Data Fiduciary, or any class of Data Fiduciaries, as an SDF. There is no user-count threshold, no turnover figure and no data-volume number that a company crosses automatically. And yet the SDF regime is the most demanding layer of the entire DPDP architecture: an India-based Data Protection Officer answerable to the board, an independent data auditor, an annual Data Protection Impact Assessment and audit cycle with significant observations reported to the Data Protection Board, due diligence over algorithmic software, and a standing power to stop specified personal data, and even the traffic data describing its flow, from leaving India.

Those obligations sit in the eighteen-month commencement tranche of the DPDP Rules, 2025 and become enforceable on 13 May 2027, eighteen months after the Rules were gazetted on 13 November 2025. From the date of this article, that is 215 days away. The compliance question for data-intensive businesses is therefore not "are we an SDF?" Nobody is, yet. It is "if designation arrived tomorrow, could we run this machinery?" For the overall statutory frame, the pillar reference is Data Privacy Compliance in India: The DPDP Act Framework. This article deals with the advanced branch of that framework that enterprise boards are least prepared for.

There Is No Automatic "Large Company Equals SDF" Rule

Designation Is a Notification, Not a Threshold

Section 10(1) of the DPDP Act gives the Central Government a discretionary power: it may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary, on the basis of an assessment of statutory factors:

Read that list carefully. Only the first factor is about the company; the remaining five are about the Republic. The statute does not say "companies with more than X crore users" or "platforms above Y turnover," and any content that publishes a definitive qualifying threshold is publishing speculation, because until a notification exists, no threshold exists. Equally, no company should describe itself in compliance papers or marketing as an SDF: designation is a sovereign act with a date, and self-labelling invites confusion about which obligations apply when.

One timing caution deserves the same precision. Industry reporting has suggested that certain SDF compliance timelines might be accelerated, and a stakeholder consultation in January 2026 did discuss shortening parts of the eighteen-month window. But no MeitY instrument amending the notified commencement schedule has been gazetted, and the operative date for Rule 13 remains 13 May 2027. Planning should build to that date while watching the Gazette, not to a consultation record.

The Government Is Already Building the Assessment File

There is a quiet signal in the Rules that designation is a when, not an if. Rule 8(3) requires every Data Fiduciary to retain personal data, associated traffic data and processing logs for a minimum of one year, for purposes listed in the Seventh Schedule, and those purposes expressly include assessment for Significant Data Fiduciary notification. In other words, the retention architecture already anticipates the Government examining processing operations to decide who gets designated. We analysed that mechanism in our DPDP data retention and erasure rules guide. The practical meaning for a data-intensive business is uncomfortable but useful: the data trail on which your designation assessment may run is the trail you are keeping right now.

What Changes the Day a Company Is Designated

Designation does not replace the ordinary Data Fiduciary obligations; it adds a second storey on top of them. Everything in the base regime, notice and consent, security safeguards, breach reporting, retention discipline, Data Principal rights, continues to apply, and Section 10(2) then adds two institutional requirements:

The DPO Requirement Deserves Its Own Weight

Section 10(2)(a) requires the SDF to appoint a Data Protection Officer who is based in India, who represents the SDF under the Act, who is responsible to the Board of Directors or equivalent governing body, and who serves as the point of contact for grievance redressal. Three design consequences follow. First, the role cannot be filled by a group privacy officer sitting in London or Singapore; the statute insists on an individual in India. Second, the reporting line runs to the board, not to general counsel or the IT function, which is a governance redesign for most Indian enterprises, not a hiring requisition. Third, because the DPO represents the company under the Act, the appointment letter, delegated authority and board interface all become compliance documents in themselves. Multinational groups that already operate a GDPR DPO and a global privacy office should read this carefully: the global architecture is a foundation, but Section 10(2)(a) requires an India-resident statutory officer with a board reporting line, and that is a structural addition, not a relabelling of the existing org chart.

The Independent Data Auditor

Section 10(2)(b) requires the appointment of an independent data auditor to evaluate compliance. Independence is the operative word: the auditor cannot be the team that built the privacy programme it is examining. For groups whose Big Four or consulting relationships already run internal audit, SOX-style testing or ISO certifications, the scoping question of who can serve as the independent data auditor, and what evidence that auditor will expect to see, belongs on the table now, because the first audit cycle will be defined by the evidence that exists, not the evidence the company wishes it had.

Rule 13 Turns DPIA and Audit into an Annual Governance Cycle

Rule 13(1) of the DPDP Rules, 2025 requires an SDF to undertake a Data Protection Impact Assessment and an audit once in every period of twelve months from the date it is notified, or included in a notified class. This is a recurring governance cycle, not a one-time certification. Rule 13(2) then does something unusual by global standards: the person carrying out the DPIA and audit must furnish the Data Protection Board with a report containing significant observations. Most privacy regimes ask controllers to hold impact assessments internally and produce them on demand; the DPDP design requires affirmative, periodic submission of findings to the regulator. An internal-only DPIA workflow of the GDPR variety will not satisfy this obligation as drafted.

The operational question this raises is the one boards should be asking now: if designation arrived tomorrow, could the company reconstruct and assess its personal-data processing architecture well enough to conduct a meaningful DPIA? A real DPIA is not a questionnaire. It requires a current inventory of processing activities, mapped data flows across business units and vendors, identified risk points against Data Principal rights, and documented mitigations. Enterprises that have never run this exercise routinely discover that assembling the inventory alone takes months, and the twelve-month clock in Rule 13(1) runs from the notification date, not from the date the company finishes getting organised. "Significant observations," incidentally, is not defined in the Rules; the prudent reading is material compliance gaps, high-risk processing and systemic weaknesses, together with their remediation plans, and companies should assume the Board will read the report exactly that way.

The Overlooked Requirement: Algorithmic Software Due Diligence

This is the section of Rule 13 that most commentary either ignores or inflates into something it is not. Rule 13(3) requires an SDF to observe due diligence to verify that technical measures, including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data, are not likely to pose a risk to the rights of Data Principals.

Two precisions matter. First, the scope is far broader than fashionable "AI compliance." The enumerated operations, hosting, storage, transmission, sharing, capture the infrastructure of ordinary digital business, not merely generative models. A defensible algorithm inventory for a large platform or enterprise would include:

Second, Rule 13(3) is not a general AI Act. It creates no model-registration, no conformity assessment and no standalone AI regulator; it is a rights-risk verification duty attached to SDF status, sitting inside a data protection statute with its own penalty schedule. Treating it as either nothing ("we do not do AI") or everything ("this regulates all artificial intelligence") are equal errors. Note also the processor dimension: algorithmic systems are frequently operated by vendors, cloud providers, SaaS platforms, analytics tools, while Section 8(1) keeps the Data Fiduciary responsible for processing undertaken on its behalf. An SDF's algorithmic due diligence that stops at its own codebase and ignores its vendor stack is diligence by halves. The processor-liability architecture is mapped in The Hidden Liability in Your Tech Stack: Why Your SaaS Vendors Expose You Under the DPDP Act; Rule 13(3) is where that architecture becomes a named statutory duty.

Does Rule 13 Require Data Localisation?

The accurate answer is: potentially, for specified data, and not universally. The baseline for every Data Fiduciary is Section 16 of the Act: cross-border transfer of personal data is permitted, except to countries the Central Government restricts by notification, a permissive regime with a negative list. Rule 13(4) then adds an SDF-specific layer with a different logic. An SDF must ensure that personal data specified by the Central Government, acting on the recommendations of a committee constituted for the purpose, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow are not transferred outside India.

Three features of this design deserve attention. It is selective, not blanket: nothing leaves the permissive Section 16 regime until the Government specifies data categories, and no such specification exists today. It is institutional: Rule 13(5) requires the recommending committee to include MeitY officials and permits other ministries and departments, which means category selection will be a whole-of-government judgement, and SDFs should treat committee output as a monitored regulatory channel. It reaches metadata: the inclusion of traffic data, the records describing where personal data flows, is broader than most localisation debates assume, and it has direct architectural consequences for global companies whose CRM, analytics and support stacks route Indian user data through regional hubs. Sectoral localisation obligations, such as the Reserve Bank's payments-data storage requirement, continue to apply independently of what the DPDP framework permits. For a multinational group, this section of Rule 13 is the one most likely to force systems change rather than paperwork change, and the cross-border data map described in the next section exists precisely so that a future specification does not arrive as an infrastructure crisis.

Should Companies Prepare Before They Are Designated?

Yes, and the framing matters: this is risk preparedness, not a prediction that any particular company will be designated, and certainly not an assertion that designation has already occurred. The case for early preparation is arithmetic, not alarmism. Designation can arrive on any day the Government chooses; Rule 13 becomes enforceable on 13 May 2027 regardless; and the assets an SDF needs, an India-based DPO with a board line, an independent auditor with a defensible evidence base, a repeatable DPIA methodology, an algorithm inventory and a cross-border data map, are precisely the assets that cannot be procured in a fortnight.

A practical SDF-readiness file for a data-intensive organisation contains nine components:

1. Processing inventory: a current record of processing activities across business units, the foundation every DPIA will stand on
2. High-risk dataset register: volume and sensitivity mapped against the Section 10(1) factors, so the company sees itself as the designation assessment might
3. Algorithm inventory: the systems table from Section IV, kept current as models and vendors change
4. Existing DPIAs and risk assessments: consolidated and gap-checked against the Rule 13(1) cycle
5. Governance reporting line: a documented answer to "who would be our DPO, and how would they reach the board?"
6. Prospective India DPO structure: role definition, delegated authority, grievance-redressal interface, and for groups, the interaction with any global privacy office
7. Auditor independence plan: who could serve as independent data auditor, and what evidence base they would inherit
8. Cross-border data map: where Indian personal data and its traffic data actually flow, including vendor and sub-processor routes
9. Processor and sub-processor register: contracts inventoried against Section 8(1) responsibility and Rule 13(3) diligence

Companies that build this file are not merely preparing for a possible designation. Every component, the inventory, the vendor register, the data map, is also what the ordinary May 2027 obligations require of all Data Fiduciaries, which makes the readiness file a no-regret investment rather than a speculative one.

The Board-Level SDF Readiness Checklist for May 2027

Because Section 10(2) puts the DPO's reporting line at the board table, the readiness question belongs there too. The matrix below is structured the way a board or audit committee should review it, one row per requirement, with named ownership and evidence rather than aspiration:

Two disciplines make the checklist real. Every row needs an evidence column that can be produced, not described: in a Rule 13 world, the audit trail is the compliance. The monitoring row is not optional: designation, data-category specification and any commencement amendment all arrive through notifications, and the first board that hears about them should be yours, not your competitor's.

The Bottom Line

The Significant Data Fiduciary regime is the DPDP framework's enterprise tier, and its central fact is also its most widely misreported one: nobody holds that status today, because Section 10 makes it a notified designation, not a size threshold. What exists today is the complete legal machinery, Section 10(2)'s India-based DPO and independent auditor, Rule 13's annual DPIA and audit cycle with Board-reported observations, the algorithmic software diligence duty, and the committee-driven power to localise specified personal and traffic data, all of it enforceable from 13 May 2027 against whoever is then designated. Data-intensive businesses should resist both available errors: claiming or assuming SDF status before any notification exists, and waiting for a notification before building governance machinery that takes quarters to assemble. The readiness file and the board matrix above are designed to be built in the 215 days that remain, on the strength of the statute as gazetted, not on the strength of predictions about who the Government will name.

This article is published for general informational purposes and reflects the DPDP Act, 2023, the DPDP Rules, 2025 as gazetted, and the notification position as at 10 October 2026. It does not constitute legal advice on any specific set of facts.