Significant Data Fiduciary Under DPDP: Obligations, DPO Requirements, Audits and Cross-Border Rules
Being designated a Significant Data Fiduciary adds four obligations no ordinary Data Fiduciary has: a resident DPO, an independent data auditor, annual Data Protection Impact Assessments, and algorithmic due diligence. MeitY has also signalled cross-border restrictions for SDFs. Here is what the designation means and how to prepare.
Under Section 10 of the DPDPA, the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary (SDF) based on volume and sensitivity of personal data processed, risk to the rights of Data Principals, and national security or public order considerations.
Designated SDFs must appoint a Data Protection Officer (DPO) based in India who reports directly to the Board of Directors, appoint an independent Data Auditor to evaluate compliance annually, and conduct periodic Data Protection Impact Assessments (DPIAs).
Need help implementing this under the DPDP Act 2023?
Talk to our legal advisors at Manoj Bhagat & Associates or estimate your annual compliance cost in 30 seconds.