India DPDPA: Article 10 – Additional obligations of Significant Data Fiduciary
10. Additional obligations of Significant Data Fiduciary
(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including
(a) the volume and sensitivity of personal data processed;
(b) risk to the rights of Data Principal;
(c) potential impact on the sovereignty and integrity of India;
(d) risk to electoral democracy;
(e) security of the State; and
(f) public order.
(2) The Significant Data Fiduciary shall—
(a) appoint a Data Protection Officer who shall—
(i) represent the Significant Data Fiduciary under the provisions of this Act;
(ii) be based in India;
(iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
(b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
(c) undertake the following other measures, namely:—
(i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
(ii) periodic audit; and
(iii) such other measures, consistent with the provisions of this Act, as may be prescribed.
What Article 10 Means for Your Business
Article 10 creates a higher tier of compliance obligations for organisations designated as Significant Data Fiduciaries (SDFs) by the Central Government. The designation is based on factors including the volume and sensitivity of data processed, national security risk, impact on democratic rights, and risk to children. If your organisation is or might be designated an SDF, Article 10 obligations require substantial additional investment in governance infrastructure.
- SDFs must appoint a Data Protection Officer (DPO) based in India, the DPO must be a senior employee, not an outsourced third party, and must report directly to the board.
- SDFs must appoint an independent data auditor to conduct periodic audits of compliance with the Act.
- Data Protection Impact Assessments (DPIAs) are mandatory for SDFs for any processing that poses a high risk to individuals’ rights.
- SDFs must undertake periodic algorithmic impact assessments to evaluate the risk of bias, discrimination, or harm from automated decision-making systems.
- The Central Government may impose data localisation requirements on SDFs, requiring certain categories of data to be stored or processed only within India.
- Even if your organisation is not yet designated an SDF, monitoring the Central Government’s criteria and preparing for potential designation is advisable for large-scale data processors.