Section 10 — DPDP Act, 2023
(1) The Central Government may, having regard to the volume and sensitivity of personal data processed, risk to rights of Data Principal, potential impact on sovereignty and integrity of India, risk to electoral democracy, security of the State, public order, or any other relevant factor, notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary. (2) Every Significant Data Fiduciary shall— (a) appoint a Data Protection Officer who shall be based in India; (b) appoint an independent data auditor; (c) undertake such other measures as may be prescribed, including— (i) periodic Data Protection Impact Assessment; (ii) periodic audit; (iii) measures relating to algorithmic accountability.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 10 creates a second compliance tier: Significant Data Fiduciary (SDF). This status is assigned by government notification — you cannot self-assess your way into it, and you cannot assume it doesn't apply. Once notified, three additional obligations attach: DPO appointment (India-based), independent data auditor appointment, and a recurring 12-month cycle of DPIAs, audits, and algorithmic accountability measures (per Rule 13). The government has not yet notified any SDFs as of October 2026.
Section 10(1) lists the factors: volume of data, sensitivity, risk to sovereignty, electoral democracy, security, and public order. Large social media platforms, major e-commerce marketplaces, and businesses processing significant volumes of financial or health data are likely candidates. The government retains full discretion — there is no self-assessment test.
Section 10(2)(a) requires the DPO to be 'based in India.' A GDPR DPO sitting in Dublin who is available to Indian users by email does not satisfy this requirement. The DPO must be physically India-based. Their role, qualification criteria, and reporting obligations are detailed in Rule 13.
Being notified as an SDF triggers a 12-month cycle that repeats indefinitely: DPIA, independent audit, and algorithmic accountability assessment — all completed within the calendar year. There is no self-assessed exemption from any of these. Rule 13 sets the specific requirements for each.