A Significant Data Fiduciary (SDF) is a Data Fiduciary, or a class of them, that the Central Government notifies under section 10 of the DPDP Act for heavier obligations. No company becomes an SDF by crossing a number on its own; the status comes only from a government notification.

How the government decides

Section 10(1) lists the factors the government weighs: the volume and sensitivity of personal data processed, the risk to the rights of individuals, the potential impact on India’s sovereignty and integrity, risk to electoral democracy, security of the State and public order. There is no headcount or revenue threshold in the Act. Banks, telecom operators, large consumer platforms and health data businesses are the kinds of entities commentators expect to see named, because of their customer data, not their payroll.

For an HR team, two things follow. A mid-sized manufacturer with 3,000 employees is unlikely to be notified on the strength of its employee records alone. But if your company is notified for its customer data, the extra duties apply to the organisation as a fiduciary, so your HRMS, biometric attendance and hiring tools fall inside the same impact assessments and audits.

The extra obligations

• Data Protection Officer: based in India, responsible to the board of directors or equivalent body, and the point of contact for grievances.
• Independent data auditor: to evaluate compliance with the Act.
• Data Protection Impact Assessment and audit: Rule 13 of the DPDP Rules, 2025 requires both once every twelve months from the date of notification, with the person conducting them reporting significant observations to the Data Protection Board.
• Algorithm checks: due diligence that technical measures, including algorithmic software, do not put individuals’ rights at risk. AI resume screening and attrition-prediction models are the obvious HR examples.
• Possible localisation: personal data in categories the government specifies, on a committee’s recommendation, must not leave India.

Failing these obligations carries a penalty of up to Rs 150 crore under the Schedule to the Act.

Frequently asked questions

Has any company been notified as an SDF yet?

Not that we could find as of late October 2026; section 10 and Rule 13 are scheduled to commence on 13 May 2027 under the phased rollout, so watch the Gazette rather than assume your status either way.

Can our payroll vendor be an SDF because of client data?

For client employee data it acts as a processor, not a fiduciary, so SDF duties attach to the employers it serves; the vendor could still be notified for data it controls itself, which is worth asking about during HRMS implementation.

Is a DPO the same as the contact person every fiduciary must publish?

No. Every fiduciary must publish someone who can answer questions about its processing, while only an SDF must appoint a formal, India-based DPO answerable to the board, and that person is also the point of contact for the grievance redressal channel for data complaints.

If your organisation might be notified, fold DPIA evidence into your yearly HR audit now so the first assessment is not built from scratch.