Who it hits
The Act gives the Central Government the power to notify a Data Fiduciary as significant, based on factors the Act sets out. These include the volume and sensitivity of the personal data processed, the risk to the rights of data principals, the potential impact on India's sovereignty and security, and other relevant factors.
Read that list carefully. It is not only about size. It is about consequence: how much data, how sensitive it is, and how much risk it creates. A mid-sized organisation handling sensitive data at volume can sit closer to the line than a consumer app with far more users.
What changes once you are an SDF
Under the Act, an SDF carries obligations beyond the baseline. In our framework, these are treated as their own domain: Domain 10, S.10, 15 obligations, ₹150 crore maximum. The substance covers four key areas:
- A Data Protection Impact Assessment: a structured, documented assessment of the risks of the processing, closer to a method than a form.
- An independent audit: a periodic audit of the SDF's compliance, conducted by someone competent to perform it.
- Periodic reporting to the Data Protection Board, as prescribed.
- Additional restrictions on cross-border transfer, where the government directs.
Notice the shape of these requirements. They are not policy requirements. They are proof requirements. A DPIA that changed nothing, an audit with no evidence, or a report that simply restates the policy will not clear the bar.
Why SDF status is a trap for the unprepared
Because the obligations are evidencing obligations, they compound. To pass an independent audit you need records. To have records you need instrumentation. To instrument you need to have decided, in advance, what evidence would prove each control. Organisations that prepare by buying a template discover this at the audit, not before it.
What to do
- Assess whether you are likely to be notified, evaluating your operations honestly against the Act's factors: volume, sensitivity, risk, and impact.
- Build the DPIA method before you are asked for it. The first DPIA should predate the designation, not follow it.
- Make the audit findable. If an independent auditor asked for your evidence tomorrow, you should be able to produce it in a day.
- Treat cross-border transfers as a tracked obligation. Record where data goes, why, and under what restriction.
SDF is where DPDP stops being a policy exercise and becomes an evidence exercise. The organisations that understand that early will find it manageable. The ones that do not will meet it at the worst possible moment.
***
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Domain 10 (S.10) is 15 obligations in our framework. Not legal advice. www.dpdpdone.com