Significant data fiduciary status is assigned by the government, not chosen.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) calls any business that determines the reasons for and the manner of handling personal data a data fiduciary. From these, the government may single out particular ones, individually or as a class, and label them significant. Being named brings duties beyond the ordinary ones.

You cannot apply for the label or decline it. Under Section 10, the Central Government looks at how much data a fiduciary handles and how sensitive it is, how much risk the processing poses to the people concerned, and broader public interests: India's sovereignty and integrity, electoral democracy, state security and public order. After notification, the fiduciary needs a Data Protection Officer (DPO) located in India who reports to its board, an independent data auditor, and a routine cycle of impact assessments and audits. A large consumer platform that waits for the notification before building these pieces will be starting from behind, because an independent audit needs records and controls that already work.

Section 10 of the DPDP Act

Lists what the government weighs before notifying a fiduciary as significant, and the extra duties that follow.

The DPDP Rules, 2025

Add detail on the yearly impact assessment and audit, a report of significant findings that goes to the Board (the Data Protection Board of India), checks on algorithmic software, and possible limits on moving specified data abroad.

A government notification

The instrument that actually names a fiduciary or a class as significant.

The board meeting agenda

Because the DPO answers to the board or an equivalent body, privacy becomes a regular agenda item.

Data fiduciary

Any business that settles what personal data is used for and how it is handled. Only those notified become significant.

Consent manager

A registered intermediary that helps people give and withdraw consent. It is a separate role with its own registration conditions.

• Compare your data volume, its sensitivity and your user numbers with the Section 10 factors, and write down what you find.
• Name a candidate DPO in India and draft how they would report to the board.
• Run a trial impact assessment on your highest-risk processing, including any automated decision software.
• Get your evidence into audit shape now; an independent data auditor will test records, not intentions.

• GuideSignificant data fiduciariesThe extra duties: DPO, audits and impact assessments.
• GuideThe DPDP Rules, 2025What the Rules add to the Act, and how they phase in.
• GuideWhat a data fiduciary must doThe duties, from notice to security to erasure.

Sources: the Digital Personal Data Protection Act, 2023, Sections 2 and 10 and the Schedule; the Digital Personal Data Protection Rules, 2025 (MeitY notification).