Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits

Practical action

Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.

Who does it apply to?

Entities notified as Significant Data Fiduciaries.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in finance, credit and insuranceGenerative AI and foundation models

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Schedules the DPO, independent audit and periodic DPIA duties.

• supportsProcessAI system owner · once per ai system
  AI impact and fundamental-rights impact assessment

  Serves 11 recorded duties · evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template

  Assessment content can be shared with the DPIA.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• Fundamental Rights Impact Assessment (FRIA)

  Assessment · DOCX and XLSX · v5

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

All 7 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every India duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits (India DPDP Act)” [AIPT-OBL-0051, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0051 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0051: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Data Protection Framework — Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, Government of India, https://www.meity.gov.in/data-protection-framework.

@misc{aipolicytracker2026_significantdatafiduciari,
  author       = {{AIPolicyTracker}},
  title        = {{Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits (India DPDP Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties}},
  url          = {https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Carry out a fundamental rights impact assessment before deployment — EU AI Act, European Union
• Carry out a data protection impact assessment for high-risk AI processing — ICO AI guidance, United Kingdom
• Conduct a data protection impact assessment for high-risk processing using new technologies — UAE PDPL, United Arab Emirates
• Deployers must complete impact assessments for high-risk AI — Colorado AI Act, Colorado (United States)
• Map context, intended use and potential impacts (Map) — NIST AI RMF, United States (voluntary)
• Operators of high-impact AI should assess its impact on fundamental rights before use — AI Basic Act, South Korea (voluntary)