Every Significant Data Fiduciary is first a Data Fiduciary. The 'significant' label is added by the Central Government for higher-risk fiduciaries, and it brings extra obligations.
Data Fiduciary
Significant Data Fiduciary
Who it is
Any person deciding the purpose and means of processing.
A fiduciary notified as higher-risk under Section 10.
Statutory reference
Section 2(i)
Section 2(z) / Section 10
How the role arises
By determining purpose and means.
By Central Government notification, on risk factors.
Data Protection Officer
Not mandatory.
Mandatory, India-based (Section 10(2)(a)).
Independent data auditor
Not required.
Required (Section 10(2)(b)).
Impact assessment and audit
Not required.
Periodic DPIA and audit required (Section 10(2)(c)).
What makes a fiduciary 'significant'?
A Central Government notification under Section 10, based on data volume and sensitivity and risks to rights, sovereignty, security and public order.
What extra duties apply?
An India-based DPO, an independent data auditor, and periodic impact assessments and audits.