Significant Data Fiduciaries: Designation, DPIAs and Audits

Executive summary

The Digital Personal Data Protection Act, 2023 (the DPDP Act) gives every data fiduciary, the business or body that decides why and how personal data is processed, the same core duties. Section 10 adds a second tier. The Central Government may designate a fiduciary as a Significant Data Fiduciary (SDF). An SDF must appoint a Data Protection Officer (DPO) based in India, appoint an independent data auditor, and carry out a periodic Data Protection Impact Assessment (DPIA) and audit. Rule 13 of the DPDP Rules, 2025 makes the DPIA and audit annual, requires due diligence on algorithmic software and lets the Government keep specified data in India.

As of October 2026 no fiduciary has been designated. Section 10 and Rule 13 commence on 13 May 2027. Breach of the SDF duties carries a penalty of up to ₹150 crore.

Four points matter most.

• Designation will come by notification, not application. In our view there will be no form to file and no threshold to self-certify. The first sign is likely to be a request for information from the Ministry of Electronics and Information Technology (MeitY).
• The clock starts on designation. Rule 13 requires the first DPIA and audit within twelve months of the notification. A business that only starts then will struggle to finish.
• The law fixes content, not method. Section 10 says what a DPIA must cover, but neither the Act nor the Rules prescribe how to run one. International standards and CERT-In's audit guidelines are useful voluntary references.
• Readiness should match exposure. Trayambic's 40 industry impact studies rated SDF likelihood High in six sectors, Medium in 21 and Low in 13. This paper turns those ratings into a self-assessment.

Background

The DPDP Act has no separate category of sensitive personal data. Health records, bank statements and an email address are protected by the same rules. Sensitivity appears in only one place: as the first designation factor in section 10(1)(a). The SDF tier is therefore the Act's main way of placing heavier duties on higher-risk processing.

The tier is not yet live. The commencement notification (G.S.R. 843(E), 13 November 2025) brings section 10, Rule 13 and most other substantive provisions into force on 13 May 2027. MeitY consulted in January 2026 on shortening the transition to 12 months, but no amending notification had been issued as of October 2026. The Data Protection Board of India, which will receive DPIA and audit reports, exists in law but has no members; MeitY invited applications on 6 May 2026.

One change has already been made. The DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), 5 October 2026) replaced "audit" with "data audit" in section 10(2)(c)(ii). Its preamble says the change removes "interpretive ambiguity regarding the scope of both categories of audit". In our view, both audit references in section 10 now point to an audit of compliance with the Act, not a financial or general IT audit.

Across Batches 2 to 5, Trayambic has published impact studies on 40 industries, each rating the likelihood of SDF designation. This paper draws those ratings together; the sector analysis stays in each study.

Legal framework

Designation: section 10(1)

The Central Government "may notify any Data Fiduciary or class of Data Fiduciaries" as an SDF "on the basis of an assessment of such relevant factors as it may determine, including":

• (a) the volume and sensitivity of personal data processed;
• (b) risk to the rights of the data principal (the individual the data is about);
• (c) potential impact on the sovereignty and integrity of India;
• (d) risk to electoral democracy;
• (e) security of the State; and
• (f) public order.

The word "including" leaves the list open. Only a data fiduciary can be designated. A data processor, which handles data on a fiduciary's behalf, cannot be designated for that work, which is why Trayambic's SaaS/IT and GCC/BPO studies rated SDF likelihood Low.

Duties: section 10(2)

An SDF must:

• appoint a DPO who represents it under the Act, is based in India, is an individual responsible to its board of directors or similar governing body, and is the point of contact for grievance redressal;
• appoint an independent data auditor to carry out a data audit evaluating its compliance with the Act;
• undertake a periodic DPIA, which the Act describes as a process comprising a description of data principals' rights and the purpose of processing, and assessment and management of the risk to those rights; and
• undertake a periodic data audit and any other measures the Rules prescribe.

What Rule 13 adds

Penalties and related powers

• Penalty. Item 4 of the Schedule sets a maximum of ₹150 crore for breach of the section 10 obligations. Other failures by an SDF, such as weak security safeguards, carry their own Schedule maximums. Under section 33 the Board may impose a penalty only for a breach it finds "significant", weighing factors such as gravity, duration and mitigation.
• Information for designation. Section 36 lets the Government require any fiduciary to furnish information. Rule 23 and the Seventh Schedule list, as one purpose, assessing whether to notify a fiduciary or class as an SDF, through a MeitY officer designated by its Secretary. Both commence on 13 May 2027.
• Possible exemption. Section 17(3) lets the Government exempt notified fiduciaries, including startups, from section 10. Nothing has been notified.

Analysis

How designation is likely to happen

Neither the Act nor the Rules provide for an application, a registration or a self-assessment filing. In our view designation will run in four steps.

1. 1.Information gathering. From 13 May 2027, MeitY can call for information to assess SDF status. A request citing that purpose is the clearest early warning a business will get.
2. 2.Assessment. The Government weighs the section 10(1) factors and any others it considers relevant. Section 10 does not require it to consult the fiduciary or give a hearing.
3. 3.Notification. The Government notifies a named fiduciary or a class. Rule 13(1) expressly contemplates both.
4. 4.The clock starts. The twelve-month DPIA and audit cycle runs from the notification, or from the date a business falls within a notified class.

Two consequences follow. First, a class notification could catch a business as it grows. If a class were defined by user numbers, as the Rules already do in the Third Schedule for erasing inactive accounts, the duties would begin when the threshold is crossed. Second, because no hearing is provided, a fiduciary that disputes designation would have to go to a High Court. Preparation is cheaper than litigation.

In our view designations are unlikely to take effect before section 10 commences on 13 May 2027.

What a DPIA under Indian law should contain

Section 10(2)(c)(i) fixes three elements: a description of data principals' rights and the purposes of processing; an assessment of the risk to those rights; and how that risk will be managed. No "other matters" have been prescribed beyond Rule 13's annual cycle. There is no official template, risk scale or method.

Three references can fill the gap. None is mandatory under the DPDP Act.

• ISO/IEC 29134:2023, Information technology — Security techniques — Guidelines for privacy impact assessment, sets out a process for privacy impact assessments and a structure for the report.
• ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance, is now a standalone management system standard for controllers and processors. It helps show that DPIA findings feed a managed programme.
• CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, 25 July 2025) govern cyber security audits by CERT-In empanelled auditors. They do not mention the DPDP Act, but their rules on auditor independence and audit data are a practical model.

The yardstick should be the Act's own: risk to the rights of data principals. A template built for the GDPR, or around information-security risk to the company, will miss Indian points such as the closed list of legitimate uses and the ban on tracking children. We suggest starting from the rights, because that is where section 10 starts.

Two design choices matter. Scope: assess each processing activity, then roll the results into the annual enterprise DPIA that Rule 13 requires. Ownership: the Act does not require the DPIA itself to be independent, so it can be run in-house. But Rule 13(2) has "the person carrying out" the DPIA and audit report to the Board. In our view the independent data auditor should at least review the DPIA, so that one person can stand behind the whole report.

The data audit and auditor independence

After the 2026 Order, both audit references in section 10 are to a "data audit", which section 10(2)(b) defines by its purpose: evaluating compliance with the Act. That is narrower than a cyber security audit and wider than a certification audit. It should test notice and consent records, rights handling, breach logs, retention and erasure, processor contracts and the Rule 13 duties themselves.

"Independent" is not defined. CERT-In's guidelines offer workable principles: auditors free from conflicts of interest and external influence; fees not contingent on the outcome; no auditing of controls the auditor implemented; and review by someone outside the audit team. Paragraph 10.3 asks auditors to keep auditee data on systems in India, encrypted, and to wipe it with a certificate at the end. An SDF should write these terms into the engagement letter, together with the auditor's Rule 13(2) duty to report to the Board.

Algorithmic due diligence in practice

Rule 13(3) is wider than "AI". It covers "technical measures including algorithmic software" used to host, display, upload, modify, publish, transmit, store, update or share personal data. Recommendation and ranking engines, content moderation, ad delivery, fraud and credit scoring, chatbots, identity checks and rules-based workflows can all fall within it. The test is whether the system is "not likely to pose a risk to the rights of Data Principals".

The Rule does not say how to show that, so the due diligence should produce evidence.

1. 1.Inventory. List every system that acts on personal data, with owner, vendor, purpose, inputs and outputs.
2. 2.Tier. Rank systems by effect on people: does the output decide access to a service, price, credit, care or visibility?
3. 3.Test before launch. Check accuracy across languages, regions, ages and genders; whether inputs exceed what the purpose needs; and whether an erasure request can be honoured in training data and outputs.
4. 4.Get vendor evidence. For third-party models and APIs, obtain documentation, test results and contractual commitments. The fiduciary remains responsible for its processors under section 8(1).
5. 5.Offer human review. Give people a route to question outcomes through the grievance channel the DPO runs.
6. 6.Monitor and record. Re-test after material changes and keep the results for the annual audit.

Voluntary benchmarks include MeitY's India AI Governance Guidelines (5 November 2025), the RBI's FREE-AI committee report (13 August 2025) for financial services and ICMR's 2023 ethical guidelines on AI in healthcare. Some sector rules already go further: SEBI has required market intermediaries to report their AI and machine learning systems since January 2019, and Karnataka's 2025 platform-based gig workers law imposes algorithmic transparency duties.

Data that must stay in India

Section 16(1) restricts transfers only to countries the Government notifies, and none has been notified. Rule 13(4) works differently. It targets SDFs and particular data, not countries: data the Government specifies on a committee's recommendation, and the traffic data about its flow, must not leave India. We have found no such specification as of October 2026. SDF-likely businesses should map which data sets are stored or processed abroad, including through AI APIs, and confirm that cloud and analytics contracts allow data to be moved to India at short notice.

A readiness framework for SDF-likely businesses

Table 1 groups the ratings from Trayambic's impact studies. A sector rating describes the typical business. Within Medium sectors, the studies almost always pointed to the largest players as the plausible candidates.

Table 2 is a self-assessment for an individual business. Score each statutory factor 0, 1 or 2. The volume bands are Trayambic's indicative markers, not legal thresholds.

Reading the score (Trayambic analysis, not a legal test). A total of 0 to 3 means monitor. A total of 4 to 6 means prepare: name a DPO-designate and pilot a DPIA on the riskiest activity. A total of 7 or more, or any business in a High-rated sector, should build the full programme before 13 May 2027. A score of 2 on any of the last three factors deserves attention whatever the total, because those factors concern State interests the Government may weigh heavily.

Worked example: a large health-tech platform

A health-tech platform offers teleconsultations, an e-pharmacy marketplace, lab bookings, a mental-health counselling service and wearable sync. Illustrative figures: 3.5 crore registered users, 15 lakh consultations a month, hosting with a cloud provider in India and product analytics through a vendor abroad. Trayambic's health-tech study rated the sector Medium for SDF likelihood; this platform sits at its top end.

Self-assessment. Volume 2, sensitivity 2, risk to rights 2 (triage and prescription routing), sovereignty 0, electoral democracy 0, security and public order 0. The total of 6 sits at the top of the prepare band, and maximum scores on the first three factors are exactly the volume, sensitivity and risk profile section 10 names first. In our view it should prepare as if designation is likely.

What it does by May 2027:

1. 1.DPO. It names a senior India-based DPO-designate, responsible to the board as section 10(2)(a)(iii) requires and reporting through its risk committee, and moves grievance handling under that office.
2. 2.DPIA register. It runs activity-level DPIAs on nine processing activities, starting with counselling records, where section 23 of the Mental Healthcare Act, 2017 adds confidentiality duties, and with AI symptom triage.
3. 3.Algorithm review. It inventories 14 systems. The triage model is tested on symptom descriptions in Hindi, Tamil and English and must route red-flag symptoms to a doctor. The doctor-ranking engine is checked so that it does not use patients' data to favour paying listings without disclosure. The refill-reminder engine is tested for withdrawal: reminders must stop within the documented time.
4. 4.Dry-run audit. It engages a firm that did not design its controls, on a fixed fee, for a March 2027 audit against the Act, and agrees that the firm may report directly to the Board under Rule 13(2) once designation comes.
5. 5.Transfer map. It confirms that the analytics vendor can process in an Indian region if a Rule 13(4) specification covers health data.

Timing. It plans to close its first formal DPIA and audit within nine months of any notification, leaving a margin inside Rule 13's twelve months. Trayambic's health-tech study covers the same business's consent design, children's data and e-pharmacy rules.

Compliance framework

Phased roadmap to 13 May 2027

• October to December 2026: self-assessment, board briefing, DPO-designate identified, algorithm and data-flow inventories begun.
• January to March 2027: DPIAs for high-risk activities, auditor appointed, contract clauses drafted.
• April to 13 May 2027: dry-run data audit, algorithm tests documented, board approves the SDF manual and residual risks.
• After any designation: DPO and auditor formally appointed; DPIA and data audit completed and reported to the Board within twelve months.

Recommendations

1. 1.Treat designation as a notification risk, not an application process, and make one person responsible for watching for MeitY information requests and Gazette notifications.
2. 2.Score your business against the six statutory factors now and record why you reached the result.
3. 3.If you are in a High-rated sector or score 7 or more, name an India-based DPO-designate with a direct line to the board before May 2027.
4. 4.Build DPIAs around the Act's test, risk to data principals' rights, using ISO/IEC 29134 and 27701 as voluntary scaffolding rather than a foreign template.
5. 5.Write auditor independence and direct reporting to the Board into the audit engagement.
6. 6.Extend algorithmic due diligence beyond AI models to every system that ranks, filters, scores or shares personal data.
7. 7.Make sure data held abroad can be moved to India without renegotiating every contract.

Key takeaways

• No Significant Data Fiduciary had been designated as of October 2026; section 10 and Rule 13 commence on 13 May 2027.
• In our view designation will come by Government notification of a named fiduciary or a class, with no application process; a MeitY information request is the likely early warning.
• Rule 13 requires a DPIA and data audit within every twelve months from designation, with the assessor reporting significant observations to the Data Protection Board.
• The Act fixes what a DPIA must cover but not the method; ISO/IEC 29134, ISO/IEC 27701 and CERT-In's audit guidelines are useful voluntary references.
• Algorithmic due diligence under Rule 13(3) reaches every system that acts on personal data, and breach of SDF duties can attract up to ₹150 crore.