Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsRole
A Significant Data Fiduciary is a Data Fiduciary the Central Government notifies as higher-risk under Section 10, carrying extra obligations.
TL;DR
A Significant Data Fiduciary (Section 10) is a Data Fiduciary the Central Government notifies as higher-risk, based on factors like data volume and sensitivity and risks to individuals and the State. Once notified, an SDF must appoint an India-based Data Protection Officer and an independent data auditor and run periodic DPIAs.
"Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.
Not every fiduciary is significant. The government designates SDFs by weighing factors such as the volume and sensitivity of data, risks to individuals, and risks to sovereignty, electoral democracy, security and public order.
Once designated, an SDF must appoint an India-based Data Protection Officer, appoint an independent data auditor, and run periodic Data Protection Impact Assessments and audits (Section 10(2)).
A large platform processing sensitive data on millions of users could be notified as an SDF and would then need a DPO, audits and impact assessments.
See how this term differs from the ones people most often confuse it with.
Data Fiduciary vs Significant Data Fiduciary →Who decides if a fiduciary is significant?
The Central Government, by notification under Section 10, based on the risk factors listed there.
What extra duties does an SDF have?
An India-based DPO, an independent data auditor, and periodic Data Protection Impact Assessments and audits.
Consultant-led and partner-backed.