Significant Data Fiduciary (SDF)
Definition
A data fiduciary designated by the central government as carrying elevated risk based on data volume, sensitivity, national security considerations, or impact on public order. SDFs face additional obligations including Data Protection Officer appointment, independent audits, and data protection impact assessments.
- Designated by
- Central government of India
- Designation basis
- Data volume, sensitivity, national security considerations, impact on public order
- Extra obligations
- Data Protection Officer appointment, independent audits, data protection impact assessments
- Governing law
- Digital Personal Data Protection Act, 2023
Common questions
How does SDF status change an organisation's compliance burden compared to an ordinary data fiduciary?+
An ordinary data fiduciary under the DPDP Act has baseline obligations such as notice and consent management, while an SDF additionally must appoint a Data Protection Officer based in India, undergo periodic independent data audits, and conduct data protection impact assessments, reflecting the higher risk the government judges its processing to pose.
Is SDF designation permanent once granted?+
The Act frames designation as based on ongoing criteria such as data volume and risk, and the government retains discretion in how it applies and revisits these designations, so an organisation's SDF status can in principle change if its processing profile or the government's risk assessment changes; the specifics depend on rules issued under the Act.
Related terms
- Consent Notice
- A notice that must be provided to the data principal before or at the time of requesting consent. It must be clear,...
- Data Fiduciary
- The term used in India's Digital Personal Data Protection Act 2023 for an entity that determines the purpose and means of processing...
- Data Principal
- The individual to whom the personal data relates. Equivalent to the data subject under GDPR. The DPDP Act grants data principals rights...
- Data Processor
- An entity that processes personal data on behalf of a data fiduciary, under the fiduciary's instructions. Equivalent to the data processor under...
- Data Protection Board of India (DPBI)
- The adjudicatory body established by the DPDP Act to receive complaints, investigate breaches of the Act, and impose penalties. The Board operates...