Home > Digital Personal Data Protection Act, 2023 > Section 10

Section 10 of the Digital Personal Data Protection Act, 2023: Additional Obligations of Significant Data Fiduciary

Section 10 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") creates enhanced compliance obligations for a Data Fiduciary that the Central Government notifies as a "Significant Data Fiduciary". The provision deals with the factors for such designation and requires additional governance measures including a Data Protection Officer, an independent data auditor, Data Protection Impact Assessments and periodic audits.

Commencement status: Section 10 is enacted but, as of 24 September 2026, is not yet in force. Under the Central Government commencement notification dated 13 November 2025, sections 3 to 5, specified parts of section 6, sections 7 to 17 and other listed provisions come into force eighteen months from publication of that notification, i.e. on 13 May 2027. Rule 13 of the Digital Personal Data Protection Rules, 2025 is also scheduled to commence eighteen months from publication of the Rules.

Meaning of Significant Data Fiduciary

A "Data Fiduciary" is the person who, alone or together with other persons, determines the purpose and means of processing personal data. A Data Fiduciary does not become a Significant Data Fiduciary merely because it processes personal data. Under Section 10(1), the Central Government must notify the Data Fiduciary, or a class of Data Fiduciaries, as Significant Data Fiduciary after assessing relevant factors.

Factors for notification under Section 10(1)

The Central Government may consider relevant factors including:

the volume and sensitivity of personal data processed;
risk to the rights of the Data Principal;
potential impact on the sovereignty and integrity of India;
risk to electoral democracy;
security of the State; and
public order.

Additional obligations under Section 10(2)

1. Appointment of a Data Protection Officer

A Significant Data Fiduciary must appoint a Data Protection Officer ("DPO"). The DPO must represent the Significant Data Fiduciary under the Act, be based in India, be an individual responsible to the Board of Directors or a similar governing body, and act as the point of contact for the grievance redressal mechanism under the Act.

2. Independent data auditor

The Significant Data Fiduciary must appoint an independent data auditor to carry out a data audit and evaluate compliance with the DPDP Act.

3. Data Protection Impact Assessment and periodic audit

Section 10 requires periodic Data Protection Impact Assessments ("DPIA"), periodic audits and other measures that may be prescribed. A DPIA is intended to describe the rights of Data Principals and the purpose of processing their personal data, assess and manage risks to their rights, and address other prescribed matters.

Rule 13 of the Digital Personal Data Protection Rules, 2025

The Digital Personal Data Protection Rules, 2025 supplement Section 10. Rule 13 provides additional operational requirements for a Significant Data Fiduciary. Once Rule 13 commences, the principal requirements include the following:

A DPIA and audit must be undertaken once in every twelve-month period from the date on which the Data Fiduciary is notified as a Significant Data Fiduciary or included in a notified class.
The person carrying out the DPIA and audit must furnish to the Data Protection Board a report containing significant observations from the DPIA and audit.
Due diligence must be undertaken to verify that technical measures, including algorithmic software used in processing activities, are not likely to pose a risk to the rights of Data Principals.
Specified personal data may be made subject to localisation restrictions where the Central Government specifies such data on the recommendation of the committee contemplated by Rule 13.

Important: The 2025 Rules use phased commencement. Rule 13 is among Rules 3, 5 to 16, 22 and 23 that are scheduled to come into force eighteen months after publication of the Rules. The statutory and rules-based obligations should therefore be read with their notified commencement dates.

Section 10 - statutory text

10. Additional obligations of Significant Data Fiduciary.

(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including-

the volume and sensitivity of personal data processed;
risk to the rights of Data Principal;
potential impact on the sovereignty and integrity of India;
risk to electoral democracy;
security of the State; and
public order.

(2) The Significant Data Fiduciary shall-

appoint a Data Protection Officer who shall-
1. represent the Significant Data Fiduciary under the provisions of this Act;
2. be based in India;
3. be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
4. be the point of contact for the grievance redressal mechanism under the provisions of this Act;
appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
undertake the following other measures, namely:-
1. periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
2. periodic audit; and
3. such other measures, consistent with the provisions of this Act, as may be prescribed.

Compliance overview

Requirement	Source	What it requires
Significant Data Fiduciary designation	Section 10(1)	Central Government notification based on an assessment of relevant statutory factors.
Data Protection Officer	Section 10(2)(a)	India-based individual with statutory representation, governance accountability and grievance-contact functions.
Independent data auditor	Section 10(2)(b)	Independent audit of compliance with the Act.
DPIA and periodic audit	Section 10(2)(c); Rule 13	DPIA and audit, including the twelve-month cycle prescribed by Rule 13 when that rule comes into force.
Algorithmic due diligence	Rule 13	Due diligence regarding technical measures, including algorithmic software, and risks to Data Principals.
Specified data localisation	Rule 13	Measures concerning specified personal data where the Central Government imposes the prescribed transfer restriction.

Official legal resources

For the authoritative text and current notifications, see the Digital Personal Data Protection Act, 2023 on India Code, the Central Government commencement notification dated 13 November 2025, and the Digital Personal Data Protection Rules, 2025 on MeitY.

Frequently asked questions

Is every Data Fiduciary a Significant Data Fiduciary?

No. Section 10 applies to a Data Fiduciary or class of Data Fiduciaries notified by the Central Government as Significant Data Fiduciary after assessment of relevant factors.

Must the DPO of a Significant Data Fiduciary be based in India?

Yes. Section 10(2)(a) expressly requires the Data Protection Officer appointed by a Significant Data Fiduciary to be based in India.

How often is a DPIA required under the 2025 Rules?

Rule 13 provides for a DPIA and audit once in every period of twelve months from the date on which the Data Fiduciary is notified as a Significant Data Fiduciary or is included in a notified class. Rule 13 itself is subject to the phased commencement specified in Rule 1.

When does Section 10 come into force?

The commencement notification dated 13 November 2025 places Section 10 in the group of provisions that come into force eighteen months after publication of that notification, i.e. on 13 May 2027.