Some fiduciaries carry a heavier load, by government notice.

1. 1Volume and sensitivityHow much personal data you process, and how sensitive it is.
2. 2Risk to peopleThe risk your processing poses to the rights of the people in your data.
3. 3Sovereignty and integrityPotential impact on the sovereignty and integrity of India.
4. 4Electoral democracyRisk to elections and democratic processes.
5. 5Security of the StateWhether the data or processing bears on national security.
6. 6Public orderPotential effect on public order.

The list is not closed: the government may weigh other relevant factors. The Rules also let a designated officer at the Ministry of Electronics and Information Technology call for information from a fiduciary to assess whether to notify it.

We have not found a designation notice yet. Prepare as if one could name your class, not only your company: a notice can cover a whole sector at once.

1. S10.1
   Data Protection OfficerRepresents the fiduciary under the Act, is based in India, answers to the board of directors or equivalent, and is the contact point for grievances.
2. S10.2
   Independent data auditorAppointed to evaluate compliance with the Act. Independence means not auditing work they built or run.
3. S10.3
   Data protection impact assessmentA periodic assessment describing people's rights and the purposes of processing, and assessing and managing the risk to those rights.
4. S10.4
   Periodic auditRegular audits beyond the independent data audit, as the Rules set out.
5. S10.5
   Other prescribed measuresAnything further the Rules require, consistent with the Act.

1. R13(1)
   Every twelve monthsA DPIA and an audit once in every twelve-month period, counted from the date of designation.
2. R13(2)
   Report to the BoardThe person who ran the DPIA and audit sends the Board a report of significant observations.
3. R13(3)
   Algorithmic due diligenceCheck that technical measures, including algorithmic software, used to host, publish, share or store personal data are not likely to put people's rights at risk.
4. R13(4)
   Localisation of specified dataCategories the government specifies on a committee's advice must stay in India, along with traffic data about their flow.

Rule 13 starts eighteen months after the Rules' publication. The list of data that must stay in India does not exist until the committee recommends it and the government specifies it.

Contact person (every fiduciary)

Someone who can answer people's questions about processing, published on your site or app and named in every rights response.

Grievance mechanism (every fiduciary)

An effective channel to resolve complaints, which people must use before going to the Board.

Data Protection Officer (significant only)

A senior, India-based officer who represents you under the Act and reports to the board.

Independent data auditor (significant only)

An outside or independent party who tests your compliance and reports what they find.

• Scale. Do you hold personal data on a large share of a market, region or demographic?
• Sensitivity. Do you process health, financial, biometric, location or children's data at volume?
• Decisions about people. Do your systems make or shape decisions on credit, jobs, insurance or access to services?
• Public reach. Can your platform spread information widely, or influence opinion or elections?
• Critical role. Are you part of payments, telecom, identity or another system the State relies on?
• Algorithms at the core. Do recommendation or ranking engines decide what people see or receive?
• Cross-border dependence. Would localising some data categories break your architecture?

• Reading the retention thresholds as the test. The user counts in the Rules' Third Schedule set erasure periods for large platforms. They are not the significant fiduciary test.
• A DPO in name only. A junior employee with no line to the board, or based abroad, does not meet the Act's conditions.
• Auditor who built the controls. An auditor reviewing their own programme is not independent.
• A one-off DPIA. The Rules ask for a DPIA every twelve months from designation, not once.

Sources: the Digital Personal Data Protection Act, 2023 (sections 8, 10 and 17, and the Schedule) and the Digital Personal Data Protection Rules, 2025 (rules 1, 9, 13 and 23, and the Third and Seventh Schedules), as published by the Ministry of Electronics and Information Technology.