Government Notification
How does a company become a Significant Data Fiduciary?
🎯 Learning Objectives
- ▸ Understand the concept of an SDF
- ▸ Learn how the government notifies an SDF
- ▸ Identify the timeline for compliance after notification
What is an SDF?
Under Section 10 of the DPDPA, the government can designate a Data Fiduciary as a "Significant Data Fiduciary" (SDF). This designation is reserved for entities that process large volumes of personal data or handle highly sensitive data, where a breach could have a massive impact on society.
Think of it as the "Big Tech" classification. Companies like Google, Meta, large banks, and major telecom operators are likely candidates for SDF status.
The DPDPA does not explicitly name any company as an SDF. The government will issue a notification listing the entities that fall into this category.
The Notification Process
The government will review the data processing activities of various companies. If a company meets the criteria, a notification will be published in the Official Gazette. Once notified, the company must upgrade its compliance framework within the timeframe specified by the government.
📖 Glossary
- Significant Data Fiduciary
- A Data Fiduciary notified by the Central Government based on the volume and sensitivity of personal data processed, risk to data principals, and impact on national security.
🔑 Key Takeaways
- SDF status is granted by the Central Government through a notification.
- It is based on the volume and sensitivity of the data processed.
- Once notified, the company must implement enhanced compliance measures immediately.
📚 Further Reading
- DPDPA Section 10 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...