DPDP reference
Rule 13: Additional obligations of Significant Data Fiduciary
Last checked 6 Nov 2026
Once every twelve months from notification, a Significant Data Fiduciary undertakes a Data Protection Impact Assessment and an audit (Rule 13(1)), and has the person carrying them out give the Board a report of significant observations (Rule 13(2)).
It checks with due diligence that technical measures, including algorithmic software, are not likely to pose a risk to Data Principals' rights (Rule 13(3)). It also ensures personal data specified by the Government on a committee's recommendation, and related traffic data, stay in India (Rule 13(4)).
- Applies to
- A Data Fiduciary or class notified as a Significant Data Fiduciary under s.10.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹150 crore (s.33, Schedule item 4).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 13; G.S.R. 892(E), corrigenda
Questions
How often must a Significant Data Fiduciary run an impact assessment?
Once in every period of twelve months from the date of notification (Rule 13(1)).
Related
- Section 10: Additional obligations of Significant Data Fiduciary
- Section 16: Processing of personal data outside India
- Rule 15: Transfer of personal data outside the territory of India
Next
Not legal advice.