Lesson 1
Who is a Significant Data Fiduciary
Most of the Act's obligations apply in the same way to every Data Fiduciary, whatever its size. Section 10 adds a second tier. The Central Government may notify any Data Fiduciary, or any class of Data Fiduciaries, as a Significant Data Fiduciary, and a fiduciary that is notified takes on extra duties on top of everything else in Chapter II. The term is defined in Section 2, but in practice an organisation becomes a Significant Data Fiduciary only through this power of notification.
The Act names the factors the government assesses when deciding on a notification. They are the volume and sensitivity of the personal data processed, the risk to the rights of Data Principals, and the possible impact on India's sovereignty, on electoral democracy, on the security of the State and on public order. Taken together, these factors point to scale, sensitivity and potential for harm. Turnover and headcount do not appear among them.
The status is a designation, not a self-assessment. No turnover figure, user count or other threshold makes an organisation a Significant Data Fiduciary automatically. An organisation should check whether a government notification covers it, either by name or as part of a notified class. It should not test itself against a figure the Act does not contain. In the same way, an organisation that has not been notified does not owe the Section 10 duties, even if it is large.
Section 10 is not yet in force. Like nearly all of Chapter II, it commences on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published on 13 November 2025, under the commencement notification G.S.R. 843(E). Separately, Section 17(3) lets the Central Government exempt notified Data Fiduciaries or classes of them, including startups, from Section 10. So the extra tier can be switched off for a notified class as well as switched on.
If a Significant Data Fiduciary breaches its additional obligations, item 4 of the Schedule to Section 33 sets a monetary penalty of up to ₹150 crore. Its ordinary duties stay in place alongside, each carrying its own exposure under the Schedule. Designation adds obligations. It does not replace any.
- Only the Central Government can make an organisation a Significant Data Fiduciary, by notifying it or a class it belongs to.
- The named factors are volume and sensitivity of data, risk to Data Principals, and impact on sovereignty, electoral democracy, State security and public order.
- There is no automatic size or revenue threshold, and an organisation cannot designate itself.
- Section 10 commences on 13 May 2027, and breaching its duties can draw a penalty of up to ₹150 crore.
Lesson 2
The additional duties of a Significant Data Fiduciary
Once notified, a Significant Data Fiduciary carries three duties beyond the ordinary Chapter II obligations: it must appoint a Data Protection Officer, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and periodic audits. These duties are added to the ordinary ones. Consent, notice, security safeguards, breach notification and the rest of Chapter II all continue to apply.
The Data Protection Officer must be based in India. The DPO represents the Significant Data Fiduciary under the Act, is responsible to its board of directors or similar governing body, and is the point of contact for its grievance redressal mechanism. The board-level line of responsibility matters. A DPO who answers only to a business unit, or who sits outside India, does not meet the requirement.
The independent data auditor's job is to evaluate the Significant Data Fiduciary's compliance with the Act. The word independent carries weight. The auditor should be independent of the function being audited, so a team reviewing systems it built or runs itself does not meet the purpose of the provision. The auditor examines compliance with the Act. It does not decide complaints or impose penalties, which are functions of the Data Protection Board.
A Data Protection Impact Assessment is a periodic assessment covering the rights of Data Principals, the purpose of the processing, and how the risks to Data Principals are managed. Section 10 requires it of Significant Data Fiduciaries, not of every Data Fiduciary. The Significant Data Fiduciary must also carry out periodic audits.
Section 10 also allows further measures to be prescribed, and Rule 13 of the DPDP Rules, 2025 is where those further measures sit. A Significant Data Fiduciary should read Rule 13 alongside Section 10 rather than treat the three statutory duties as the complete list. All of this commences on 13 May 2027, and breach of these additional obligations can draw a penalty of up to ₹150 crore under item 4 of the Schedule to Section 33.
- The three statutory extras are an India-based DPO, an independent data auditor, and periodic DPIAs and audits.
- The DPO represents the Significant Data Fiduciary, answers to its board or governing body, and is the grievance point of contact.
- The data auditor must be independent and evaluates compliance with the Act.
- A DPIA covers Data Principal rights, the purpose of processing and the management of risk.
- Rule 13 of the DPDP Rules, 2025 adds further measures to be read with Section 10.
Lesson 3
The Data Protection Officer and the contact person
Every Data Fiduciary, significant or not, has to give Data Principals someone to contact. Section 8 requires it to publish the business contact information of a Data Protection Officer, where one is required, or of another person who can answer the Data Principal's questions about the processing of her personal data. In practice this is published on the fiduciary's website or app.
The same contact appears at the point of consent. Section 6 requires every consent request to give the contact details of a Data Protection Officer, where one applies, or of another authorised contact person. A Data Principal deciding whether to consent can therefore see straight away who will answer for the processing.
This is the key difference. An ordinary Data Fiduciary meets the requirement by naming a contact person who can answer processing questions. The Act does not require it to appoint a Data Protection Officer. A Significant Data Fiduciary has no such choice. Section 10 requires it to appoint a DPO who is based in India, represents it under the Act, is responsible to its board or governing body, and is the point of contact for its grievance redressal mechanism.
Both roles connect to grievance redressal. Section 8 requires every Data Fiduciary to run an effective grievance redressal mechanism, and Section 13 gives the Data Principal a right to readily available grievance redressal, with a response within the period Rule 14 of the DPDP Rules, 2025 prescribes. A Data Principal must use this channel before she can take a complaint to the Board. For a Significant Data Fiduciary, the DPO is the point of contact for that mechanism.
It helps to keep the contact details the same on the website or app, in notices and in every consent request, so a Data Principal reaches the same point whichever route she takes. These provisions commence on 13 May 2027, with the rest of Chapters II and III.
- Every Data Fiduciary must publish the business contact details of a DPO, where one is required, or of another person who can answer processing questions.
- Every consent request must carry the DPO's or an authorised contact person's details.
- Only a Significant Data Fiduciary must appoint a DPO, who must be India-based and responsible to the board.
- A Data Principal must use the fiduciary's grievance channel before complaining to the Board.
Lesson 4
Transferring personal data outside India
Section 16 takes what is often called a negative-list approach. Transfer of personal data for processing outside India is allowed by default. The Central Government may, by notification, restrict transfers to specific countries or territories. Until it notifies a restriction for a destination, transfer to that destination is permitted. The Act contains no list of approved countries that a destination must be on first.
In practice, before sending personal data abroad, a Data Fiduciary should check whether the destination is covered by a notified restriction. Only a notified restriction narrows the default permission. A transfer to a notified restricted destination in breach of that notification has no named Schedule item of its own, so it falls under the residual item 7 of the Schedule to Section 33, with a penalty of up to ₹50 crore. Rule 15 of the DPDP Rules, 2025 should be read alongside Section 16.
Section 16 does not override any other Indian law that sets a stricter standard for particular personal data or a particular Data Fiduciary. A sectoral rule elsewhere that requires certain data to be kept in India still applies on top. This fits the general rule in Section 38: the Act is in addition to other laws, not in derogation of them. The DPDP Act therefore imposes no general data localisation requirement, but it leaves stricter sectoral requirements intact.
A notification restricting transfers is subject to parliamentary oversight. Section 41 requires every notification issued under Section 16 to be laid before both Houses of Parliament for a total of thirty days. If both Houses agree to modify or annul it, it takes effect only in the modified form or ceases to have effect, without affecting anything already validly done under it.
Sending data abroad does not move the fiduciary's obligations with it. Section 8 keeps the Data Fiduciary responsible for compliance whatever its contracts say, and any Data Processor, in India or overseas, must be engaged under a valid contract. Section 16 commences on 13 May 2027.
- Transfer outside India is permitted by default, except to countries or territories the Central Government restricts by notification.
- A stricter sectoral law, such as a localisation rule, still applies, because Section 16 does not override it.
- Section 16 notifications must be laid before both Houses of Parliament under Section 41.
- The Data Fiduciary stays responsible for compliance wherever the data is processed.
Lesson 5
Exemptions under Section 17
Section 17 sets out exemptions. They are narrow and tied to particular purposes, and they are not a general way to opt out of compliance. They should not be confused with the scope carve-outs in Section 3, which take purely personal or domestic processing, and data the Data Principal has made public, outside the Act altogether. Section 17 deals with processing that is within the Act but relieved of some or all of its obligations.
Sub-section (1) exempts the following processing from most of the obligations in Chapters II and III. It covers processing necessary to enforce a legal right or claim. It covers processing by a court, a tribunal, or any body performing a judicial, quasi-judicial, regulatory or supervisory function. It covers processing in the interest of preventing, detecting, investigating or prosecuting an offence. It covers processing by a person based in India, under a contract, of personal data of Data Principals who are not in India. It covers processing necessary for a court-approved merger, demerger or corporate restructuring. And it covers processing to ascertain the financial position of a person who has defaulted on a loan.
Even where sub-section (1) applies, Section 8(1) and Section 8(5) remain. The fiduciary is still responsible for compliance, and it must still take reasonable security safeguards to prevent a personal data breach. Accountability and security are never exempted under this sub-section.
Sub-section (2) goes further and exempts the whole Act in two cases. The first is processing by an instrumentality of the State that the Central Government notifies, on grounds of sovereignty, security, public order or foreign relations. The second is processing for research, archiving or statistical purposes, provided the data is not used to take any decision specific to a Data Principal and the processing follows prescribed standards. Rule 16 of the DPDP Rules, 2025 sets those standards.
Three further powers complete the section. Under sub-section (3), the government may notify Data Fiduciaries or classes of them, including startups, as exempt from Section 5 (notice), Sections 8(3) and 8(7) (accuracy and erasure), and Sections 10 and 11 (Significant Data Fiduciary duties and the access right). Under sub-section (4), processing by the State is exempt from Section 8(7), and, where it does not lead to a decision about a specific Data Principal, from the correction and erasure duties in Section 12(2) and (3). Under sub-section (5), the government may exempt any Data Fiduciary or class from any provision of the Act for a specified period, by a notification issued before the Act's fifth anniversary.
None of these exemptions is self-declared where it depends on a notification. A startup is not exempt until it or its class has actually been notified. If an organisation relies on an exemption that does not apply, the underlying obligation stays in place, along with its normal penalty under the Schedule to Section 33. Section 17 commences on 13 May 2027. Section 11 has a related carve-out: the access right does not cover sharing with another Data Fiduciary that is legally authorised to obtain the data, such as sharing made on a written request for the prevention or investigation of an offence.
- Section 17(1) covers legal claims, courts and regulators, offences, contract processing of non-Indian Data Principals' data, court-approved mergers and loan defaulters.
- Sections 8(1) and 8(5), accountability and security safeguards, survive every sub-section (1) exemption.
- Notified State instrumentalities, and research, archiving or statistics that feed no individual decision, are exempt from the whole Act.
- Startups and other classes are exempt from specific provisions only once the Central Government notifies them.
- Relying on an exemption that does not apply leaves the underlying obligation, and its penalty, in place.
Lesson 6
Record-keeping and demonstrating accountability
The Act places accountability firmly on the Data Fiduciary. Under Section 8, it is responsible for complying with the Act for processing done by it or on its behalf, whatever any contract says and even if the Data Principal has not met her own duties under Section 15. It must also put in place appropriate technical and organisational measures to make sure the Act is actually observed. As the previous lesson showed, these accountability and security duties survive even the Section 17(1) exemptions.
Several provisions turn that accountability into a need for evidence. The clearest is Section 6(10). If consent is challenged, the burden of proving that valid notice was given and valid consent obtained falls on the Data Fiduciary, not on the Data Principal. A fiduciary that cannot produce records of notice and consent cannot meet that burden, and the processing then has no lawful ground to rely on.
Security is the second area. Rule 6 of the DPDP Rules, once in force, sets out what reasonable security safeguards include: encryption, masking or similar measures; access control; monitoring and logging; backups; contracts that bind processors to the same safeguards; and keeping breach-related logs for one year. Records of these measures show that the Section 8(5) duty is being met. Failing to take reasonable security safeguards carries the Act's highest penalty, up to ₹250 crore.
Third, under Section 36 the Central Government may call for information from any Data Fiduciary, and the fiduciary must furnish it. The Act gives no separate notice period for this, so records should be organised well enough to answer such a request promptly. If the Board inquires into a breach, Section 33 requires it to weigh, among other factors, whether and how effectively the breach was mitigated, so documented mitigation steps can make a difference to the penalty within the Schedule's ceiling.
For a Significant Data Fiduciary, the Section 10 duties produce their own record. Periodic Data Protection Impact Assessments, periodic audits and the independent data auditor's evaluation together show how it manages risk to Data Principals. The duties discussed in this lesson that come from Sections 6, 8 and 10 commence on 13 May 2027.
- The Data Fiduciary stays responsible for compliance whatever its contracts say.
- Section 6(10) puts the burden of proving valid notice and consent on the Data Fiduciary, so keep the records.
- Rule 6 requires breach-related logs to be kept for one year.
- A Data Fiduciary must furnish information the Central Government calls for under Section 36.
- Documented mitigation is a factor the Board must weigh under Section 33.
Check yourself
5 random questions from this module. Answers are marked straight away and don't count toward the exam.