Section 10 Explained: Significant Data Fiduciary Obligations

The Digital Personal Data Protection Act, 2023 establishes a two-tiered compliance structure through Section 10. The Central Government holds the power to notify specific entities as Significant Data Fiduciaries. This designation imposes a layer of heightened obligations above the baseline rules applicable to standard organizations. A notification activates duties regarding localized leadership, independent evaluation, and structured risk assessment under the DPDP Rules, 2025. Organizations cannot self-classify under this framework. The government determines the status based on a specific set of statutory factors. Designated entities appoint a resident Data Protection Officer to oversee operations. They also engage an independent data auditor to review their compliance posture. These fiduciaries execute periodic Data Protection Impact Assessments to map systemic risks. The framework shifts responsibility directly to the board of directors. Large processing operations face intense scrutiny to verify compliance with data principal rights.

Section 10, sub-section 1 defines the parameters for this advanced designation. The Central Government conducts an assessment using six primary factors. Regulators first evaluate the volume and sensitivity of personal data processed by the entity. The government weighs these metrics against the potential risk to the rights of the Data Principal. The scope of assessment then shifts to national interests. Authorities examine any potential impact on the sovereignty and integrity of India. They evaluate risks to electoral democracy, the security of the State, and public order. A notification applies to an individual Data Fiduciary or an entire class of Data Fiduciaries operating in a similar sector. Applying the rule to a class allows regulators to enforce uniform controls across specific industries, such as telecommunications or major retail banking. A financial institution holding fifty million active accounts hits multiple triggers in this assessment. This classification mechanism covers domestic enterprises and foreign entities processing data to offer goods or services within India.

Section 10, sub-section 2 dictates strict organizational changes for a notified Significant Data Fiduciary. The entity has a statutory mandate to appoint a Data Protection Officer who is based in India. This individual represents the organization under the provisions of the Act and acts as the primary point of contact for the grievance redressal mechanism. The legislation prohibits burying this officer deep within a compliance or legal department. Section 10, sub-section 2 requires the Data Protection Officer to be an individual responsible directly to the Board of Directors or a similar governing body. Directors review grievance volumes and breach metrics during formal board meetings. The corporate secretariat records this direct oversight in the official minutes. The Data Protection Board of India reviews these internal governance documents during compliance inquiries. A localized reporting structure forces multinational corporations to establish a domestic executive presence capable of answering to Indian regulatory authorities.

An independent data auditor completes the external oversight loop for a Significant Data Fiduciary. The designated organization appoints this professional to evaluate compliance with the provisions of the Act. The auditor operates entirely outside the internal data management hierarchy. Their mandate covers the core processing systems and the entire supply chain of external vendors. Section 8, sub-section 1 makes the Data Fiduciary responsible for compliance in respect of any processing undertaken on its behalf by a Data Processor. This liability remains absolute regardless of any contract terms passing blame to the vendor. Section 8, sub-section 2 restricts an entity to using a Data Processor only under a valid contract. The independent data auditor reviews these specific agreements. Section 8, sub-section 3 applies when personal data is likely to be used to make a decision that affects the Data Principal or is disclosed to another Data Fiduciary. The processing entity guarantees the completeness and accuracy of that data. The independent auditor checks the verification protocols to confirm they meet this statutory standard before any disclosure occurs.

A designated entity performs periodic Data Protection Impact Assessments alongside the independent audit. The DPDP Rules, 2025 detail the frequency and scope of these mandatory evaluations. The compliance team maps the lifecycle of collected information to identify threats to data privacy. These internal assessments support the operational delivery of data principal rights outlined in Section 11. Under Section 11, sub-section 1, a Data Principal has the right to obtain a summary of personal data being processed by the fiduciary. They possess the right to demand the identities of all other Data Fiduciaries and Data Processors with whom their personal data has been shared. The fiduciary responds with a description of the exact information shared with those third parties. A Data Protection Impact Assessment identifies where these data transfers occur. A processing system failing to track these downstream disclosures violates Section 11 rights. The independent auditor reviews the assessment reports to confirm the organization can generate these requested summaries.

The Schedule to the DPDP Act sets distinct financial penalties for violating Section 10 duties. A Significant Data Fiduciary faces fines up to 150 crore rupees specifically for failing to fulfill these additional obligations. The Data Protection Board of India decides the exact financial penalty based on the severity and duration of the non-compliance. Failing to conduct a Data Protection Impact Assessment before deploying a new core processing system exposes the organization to this massive fine. Operating without a resident Data Protection Officer carries the exact same financial risk. The regulatory inquiry examines board meeting records to confirm the governing body actively supervised this officer. A paper appointment lacking documented executive oversight results in a direct violation. The 150 crore rupee ceiling applies exclusively to the Section 10 mandates. This punishment sits entirely separate from the penalties applied for baseline processing failures or data breaches.

Complying with these statutory obligations requires extensive architectural changes to data handling processes. The DPDP Rules, 2025 mandate strict timelines for operational readiness. Institutions have 216 days remaining until the compliance deadline of 13 May 2027. Designated entities begin this transition by hiring a resident Data Protection Officer. The corporate board drafts a formal resolution establishing a direct reporting line for this executive. The organization issues a request for proposal to engage an independent data auditor. The internal legal team compiles an inventory of all vendor contracts executed under Section 8 for the auditor to review. Information technology teams launch initial Data Protection Impact Assessments across all legacy platforms to map data flows. An accurate flow map guarantees the entity can answer a Section 11 request for a processing summary. Evaluate internal governance controls and track exact statutory requirements by visiting https://www.complydp.com/audit-preview today.