Significant Data Fiduciary Rules in India: DPDP Rule 13

Short answer

A Significant Data Fiduciary (SDF) is an organisation the Central Government notifies under Section 10 of India's Digital Personal Data Protection Act, 2023, usually because of the volume and sensitivity of the personal data it processes. If notified, you must appoint a Data Protection Officer based in India who reports to your board, appoint an independent data auditor, and — under Rule 13 of the DPDP Rules, 2025 — complete a Data Protection Impact Assessment and audit every twelve months, carry out due diligence on your algorithmic software, and keep specified data inside India.

These duties sit in the tranche of the Rules commencing eighteen months after notification, which puts them in mid-May 2027. As of early October 2026 no SDF designations have been published, and MeitY has floated — but not notified — a proposal to bring SDF deadlines forward. Stratgik is a technology firm, not a law firm; what follows is implementation guidance, not legal advice.

Where the SDF rules sit in the DPDP timeline

MeitY notified the DPDP Rules, 2025 by gazette on 13 November 2025 (G.S.R. 846(E)), announced publicly the following day, and simultaneously established the Data Protection Board. The Rules do not all start at once: housekeeping and Board provisions started immediately, Consent Manager registration follows at the twelve-month mark, and the substantive obligations — notice and consent, security safeguards, breach reporting, children's data, data principal rights, cross-border transfers and the SDF duties — land eighteen months after notification. Published summaries cite that date as either 13 or 14 May 2027 depending on how the count is read; treat mid-May 2027 as the planning deadline and check the gazette for a date you need in a contract.

Two things are unsettled. No SDF or class of SDF has been notified yet, so nobody in India is formally an SDF today. And MeitY discussed compressing the SDF timeline at a January 2026 stakeholder consultation — reportedly to around twelve months, bringing DPO appointment, impact assessments and third-party audits forward. That proposal has not been notified, so the eighteen-month date remains the legal position, but it is a reason not to leave readiness until 2027.

Who gets designated, and why you cannot self-certify

SDF status is conferred, not chosen. Section 10(1) lets the Central Government notify a single Data Fiduciary or a whole class as significant after assessing relevant factors, which the section lists as the volume and sensitivity of personal data processed, the risk to the rights of data principals, the potential effect on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order.

There is no threshold in the Act — no "over X million records" trigger — and the Rules add none. You cannot look up a number and conclude you are safe. What you can do is assess how likely designation is for your sector and scale, and how long the controls would take to build if a notification arrived with a short runway.

The organisations that should assume they are candidates: large consumer platforms and marketplaces, banks, NBFCs and insurers, telecom operators, large health groups, credit bureaux and account aggregators, and social media intermediaries with substantial Indian user bases. Circulating estimates of how many entities might be covered are projections, not government figures.

The six SDF obligations, and what each one actually requires

Three obligations come from Section 10(2) of the Act and three more from Rule 13 of the Rules. Read together, they are the operational substance of SDF status.

Two of these are where engineering work actually lands.

Algorithmic due diligence is an engineering obligation, not a policy paragraph

The draft Rules addressed algorithmic software; the notified version is broader, covering technical measures generally. If you run models for credit decisions, pricing, fraud scoring, content ranking, underwriting or hiring shortlists, you will need evidence — not an assertion — that they do not put data principals' rights at risk: an inventory of models touching personal data, recorded inputs and features, a record of what was tested and found, human review where outcomes are consequential, and version history you can reconstruct a year later. Our AI automation opportunity scanner helps decide which systems are in scope first.

Localisation is conditional, and the list does not exist yet

Rule 13(4) does not localise all personal data held by an SDF. It applies to categories the Central Government specifies on the recommendation of a committee constituted for the purpose, which must include MeitY officials and may include other ministries. No such specification has been published. The practical consequence is architectural: know today which datasets sit in which region and how long it would take to move a category into India, because that determines whether a future notification is a configuration change or a nine-month migration. Our managed technology practice deals with the same trade-offs for Indian workloads.

What non-compliance costs

The Schedule to the DPDP Act sets maximum penalties per breach. They are worth reading in order, because the largest numbers are not attached to SDF status itself.

These are ceilings, not tariffs: the Board determines the amount and must consider factors such as the nature and gravity of the breach and any mitigation. The Board has been established, but its chairperson and members had not been appointed as of the most recent public tracking, so no enforcement record exists yet. Nobody can tell you what a typical penalty looks like.

A twelve-month readiness plan

If designation is plausible for your organisation, the sequence below front-loads the work with long lead times. The order matters more than the calendar.

• Months 1–3 — know what you hold. Build a personal data inventory: datasets, purposes, lawful basis, retention, systems, and the region each dataset is stored and processed in. Map processors and sub-processors, including analytics, support tooling, CRM and model APIs that receive personal data. List every system running a model on personal data, with an owner and decision impact.
• Months 4–6 — appoint and govern. Appoint a DPO based in India with a reporting line to the board, and publish the contact route. Shortlist independent data auditors; the Rules prescribe no accreditation scheme for data auditors, so selection criteria — sector experience, technical depth, independence — are yours to define. Stand up a DPIA methodology and run the first assessment on your highest-risk processing rather than on everything at once.
• Months 7–9 — build the controls. Implement consent capture and withdrawal with an audit trail, retention and deletion enforcement, and data principal request handling. Close breach detection gaps so the 72-hour reporting obligation is achievable. Document algorithmic due diligence: test records, human review points, model versioning.
• Months 10–12 — rehearse. Dry-run an internal audit against Section 10 and Rule 13, rehearse a breach notification end to end including the Board report, and confirm you could relocate a defined dataset to India within a known timeframe.

Compliance checklist

• Personal data inventory complete, with storage and processing region per dataset
• Processor and sub-processor register current, with data protection terms in place
• DPO appointed, based in India, reporting to the board, contact details published
• Independent data auditor engaged, with scope and independence documented
• DPIA methodology approved; first assessment done on highest-risk processing
• Twelve-month DPIA and audit cadence scheduled, with an owner for the Board report
• Model inventory with test evidence and human review points
• Consent capture, withdrawal and audit trail implemented; retention enforced technically, not only in policy
• Data principal request workflow operational, and the 72-hour breach reporting path tested
• Data residency map maintained, with a costed plan to relocate specified categories to India
• Board-level reporting on DPDP readiness, with named accountability

Where this usually goes wrong

Two failure modes are common and opposite in shape. The first is treating DPDP as a document exercise: the privacy policy is rewritten, a register appears in a spreadsheet, and nothing changes in the systems that hold the data. That survives a policy review and fails an audit, because Rule 13 asks for assessment and verification, not a statement of intent. The second is over-building ahead of a notification that may never come — appointing a DPO, mapping data and fixing retention are worth doing regardless, since every Data Fiduciary needs most of it by mid-May 2027; commissioning a full third-party audit programme before designation usually is not.

The sensible split: build what is useful under the general obligations now, and hold the SDF-specific items — auditor engagement, Board reporting line, localisation migration — as costed plans you can trigger on notification. Our build vs buy tool frames the consent-tooling choice, and our DPDP compliance implementation page sets out how the technical work is usually sequenced.

Frequently asked questions

Am I a Significant Data Fiduciary if I process a lot of personal data?

Not automatically. SDF status applies only when the Central Government notifies you, or a class you belong to, under Section 10(1). Volume and sensitivity are among the factors weighed, but there is no numeric threshold in the Act or Rules and no mechanism for self-designation. Until a notification is published, no organisation is an SDF.

When do the SDF obligations actually start?

Rule 13 falls in the eighteen-month tranche of the DPDP Rules, 2025, which puts it in mid-May 2027. The twelve-month DPIA and audit clock then runs from the date you are notified as an SDF, or from the date you fall within a notified class. MeitY has discussed compressing the SDF timeline, but that has not been notified.

Does the DPDP Act require all personal data to be stored in India?

No. The Act restricts transfers to countries the government notifies rather than imposing a general localisation mandate. Rule 13(4) is narrower still: it applies only to categories of personal data and related traffic data the Central Government specifies for SDFs, on a committee's recommendation. No such specification has been published, so there is no SDF localisation list to comply with today.

Can our existing ISO 27001 or SOC 2 auditor serve as our independent data auditor?

Possibly, but not automatically. The Act requires an auditor independent of the fiduciary who evaluates compliance with the Act, and the Rules set out no accreditation scheme or prescribed qualifications. An existing security auditor may be suitable if they can show independence and DPDP-specific competence, which is a different scope from an information security certification audit. Put this question to your legal advisers.

Do we need a DPO if we are not an SDF?

The Section 10(2)(a) DPO requirement — India-based, board-reporting — applies to SDFs. Every Data Fiduciary must still publish contact details for someone who can answer questions about its processing, and must run a grievance redressal mechanism. It is usually simpler to appoint one accountable person now and widen the mandate if designation follows.

What happens to the twelve-monthly audit report we send to the Board?

Rule 13(2) requires the SDF to ensure the person conducting the DPIA and audit furnishes a report of significant observations to the Data Protection Board. The Rules prescribe no format and no public disclosure obligation, and because the Board is not yet fully constituted there is no practice yet on how those reports will be handled.

Next steps

In October 2026, SDF designation is a planning risk rather than a present obligation: the rule text is final, commencement is mid-May 2027, no designations have been published, and the timeline could move forward. That rewards doing the inventory and governance work now and holding the SDF-specific build as a costed, triggerable plan. For help sizing it, see our India technology hub or the technology decision sprint. Published by the Stratgik team. Stratgik is a technology firm, not a law firm, and does not provide legal advice.

Sources

• Press Information Bureau — DPDP Rules, 2025 notified
• DPDP Rules, 2025 — full text (DSCI)
• Shardul Amarchand Mangaldas — enforcement and notification of the DPDP Rules
• KPMG in India — DPDP Rules 2025 implementation guidance
• Compression of the DPDP enforcement timeline proposed by MeitY