DPDP reference
Section 10: Additional obligations of Significant Data Fiduciary
Last checked 6 Nov 2026
The Central Government may notify a Data Fiduciary or class as a Significant Data Fiduciary, looking at factors including the volume and sensitivity of the data, risk to Data Principals' rights, sovereignty, electoral democracy, security of the State and public order (s.10(1)).
A Significant Data Fiduciary appoints a Data Protection Officer who is based in India and responsible to its board (s.10(2)(a)), appoints an independent data auditor (s.10(2)(b)), and undertakes periodic Data Protection Impact Assessments and periodic data audits (s.10(2)(c), as reworded by S.O. 5458(E)). Rule 13 sets the yearly cycle.
- Applies to
- Only a Data Fiduciary or class the Central Government notifies under s.10(1).
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to ₹150 crore (s.33, Schedule item 4).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 10; G.S.R. 843(E), commencement; S.O. 5458(E), Removal of Difficulties Order, 2026
Questions
Does every business need a Data Protection Officer?
The duty to appoint one in s.10(2)(a) is on a Significant Data Fiduciary. Other Data Fiduciaries publish contact details of a person who can answer questions (s.8(9)).
Related
- Rule 13: Additional obligations of Significant Data Fiduciary
- Section 8: General obligations of Data Fiduciary
- Section 33: Penalties
Next
Not legal advice.