A client I was advising on DPDP readiness last month asked me something that a lot of growing companies eventually ask: “We’re not a bank, we’re not Google — surely this ‘Significant Data Fiduciary’ thing doesn’t apply to us?”
It’s a reasonable assumption. And for most small businesses, it’s true. But the criteria aren’t only about company size — volume and sensitivity of data, and the potential impact on India’s sovereignty and electoral democracy, all factor in. If your business has scaled fast, added sensitive categories of data, or expanded into certain sectors, this is worth checking properly rather than assuming.
What Is a Significant Data Fiduciary?
Under the DPDP Act, a Data Fiduciary is any entity that decides why and how personal data is processed — which, practically, is almost every business with a customer database. A Significant Data Fiduciary (SDF) is a subset of these, notified specifically by the central government based on factors that include:
- The volume and sensitivity of personal data processed
- Risk to the rights of Data Principals
- Potential impact on India’s sovereignty and integrity
- Risk to electoral democracy
- Security of the state
- Public order
Unlike some data protection laws where you self-assess your own category, SDF status under the DPDP Act is notified by the government — you don’t decide it, and you don’t apply for it. But that doesn’t mean you can ignore the question; the criteria give you a reasonable way to estimate whether you’re likely to be in scope.
Who Is Likely to Be Classified as an SDF?
While the final list will come through government notification, based on the scale and sensitivity criteria, businesses that typically fall into higher-risk territory include:
- Large fintech and payment platforms processing financial data at scale
- Healthtech and diagnostic platforms handling sensitive health data
- Social media and large consumer platforms with millions of users
- E-commerce platforms with extensive behavioural and transaction data
- Companies processing large volumes of children’s data
- Organisations processing data that could affect public order or electoral processes (e.g., large-scale voter data handling, political consulting)
- Any business processing data at genuinely large national scale, regardless of sector
Most SMEs, local service businesses, single-city clinics, and early-stage startups are very unlikely to meet this bar in their current form — but growth changes that calculus quickly.
What Changes If You’re Classified as an SDF?
This is where the obligations meaningfully increase. If notified as a Significant Data Fiduciary, a business must:
1. Appoint a Data Protection Officer (DPO) based in India Not just a compliance point of contact — a designated DPO who reports to the company’s board or governing body and acts as the point of contact for grievance redressal.
2. Appoint an independent data auditor SDFs must have their data processing activities and compliance measures periodically audited by an independent auditor.
3. Conduct a Data Protection Impact Assessment (DPIA) This is a structured exercise to identify and document risks to Data Principals before starting or significantly changing a data processing activity — not a one-time checkbox, but a periodic requirement.
4. Undergo periodic compliance audits Beyond the independent audit, SDFs face a higher standard of ongoing self-assessment and documentation.
5. Face possible restrictions on certain data processing Depending on future rules, the government retains power to restrict SDFs from transferring certain categories of personal data outside India.
What Should You Do Right Now?
Even without a final government-notified list, you can reasonably self-evaluate using the criteria above. A few honest questions help:
- Do we process personal data at genuinely large scale — not “a lot for us,” but nationally significant volume?
- Do we handle particularly sensitive categories — health records, financial data, biometric data, or children’s data — at scale?
- Have we expanded into a sector (fintech, healthtech, political consulting, large-scale advertising/data brokerage) that regulators are likely to scrutinise closely?
- Are we growing fast enough that the answer to the above could change within 12–18 months?
If you answered yes to any of these, it’s worth building DPO capacity and DPIA processes proactively — not because you’re definitely an SDF today, but because retrofitting this governance under regulatory pressure later is far more expensive than building it now.
Why This Matters Even If You’re Not (Yet) an SDF
Here’s the part founders often miss: the practices required of an SDF — a real DPO, documented risk assessments, independent audits — are simply good data governance. Building toward this standard early doesn’t just prepare you for potential SDF classification later; it reduces your breach risk, your liability exposure, and the chaos of a rushed compliance scramble when your business crosses whatever threshold gets notified.
We Can Help You Assess Your Exposure
We work with growing businesses in fintech, healthtech, and data-heavy sectors to assess SDF exposure, build DPO capacity, and set up the DPIA and audit processes that regulators will expect — before classification becomes a scramble.
Book a free preliminary compliance assessment →
This article is for general informational purposes and does not constitute legal advice. For guidance specific to your business, book a consultation.