Lesson 8.5: Significant Data Fiduciaries and Rule 13

Module 8 · Lesson 8.5 of 6 · About 30 minutes · Significant Data Fiduciaries and Rule 13

Large or high-risk fiduciaries carry extra duties. This DPDPA 2023 course page explains significant data fiduciaries and rule 13 in plain language.

significant data fiduciaries and rule 13 - DPDPA 2023 course lesson banner

What you will learn about significant data fiduciaries and rule 13

Understand how SDFs are notified
List SDF duties
Know the annual DPIA and audit

Section 10 and Rule 13 (significant data fiduciaries and rule 13)

The Government may notify an SDF based on volume and sensitivity of data, risk to principals, potential impact on sovereignty and security, risk to democracy and public order. An SDF must appoint a Data Protection Officer based in India who reports to its Board, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and an audit once every 12 months and report to the Board. It must also verify that algorithmic software does not pose risk, and process specified data only as the Government directs on localisation. Failure can attract a penalty up to Rs 150 crore.

SDF duties: click each

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

DPIA outline (significant data fiduciaries and rule 13)

Step	Content
Describe	Process, data, purpose
Assess	Risks to principals
Mitigate	Controls
Sign-off	Management and DPO

Worked example

A large payments platform is notified as an SDF. It appoints a DPO, commissions an annual audit, and files the DPIA summary to its Board.

Activity (5 minutes) (significant data fiduciaries and rule 13)

Read How to do a DPIA and annual audit and complete the DPIA-lite template.

Key takeaway: Even if you are not an SDF, a small DPIA on risky projects is good practice.

Check your understanding of significant data fiduciaries and rule 13

Q1. SDF DPO must be based in:

Q2. DPIA and audit frequency:

Q3. SDF penalty up to:

← Exemptions for children’s data: Rule 12 and the Fourth Schedule Children and SDF practice and module test →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for significant data fiduciaries and rule 13: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.