{"slug":"india-dpdp-significant-data-fiduciary-duties","id":"AIPT-OBL-0051","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0051","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","short_title":"Significant Data Fiduciary duties","category":"impact_assessment","summary":"Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protection Officer based in India, an independent data auditor, and periodically undertake data protection impact assessments and audits.\n","practical_action":"Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.","is_binding":true,"applies_from":null,"section":null,"source_reference":"Section 10","official_source_url":"https://www.meity.gov.in/data-protection-framework","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["finance_and_credit","generative_ai"],"applicability":[{"description":"Entities notified as Significant Data Fiduciaries.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Data protection impact assessment","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4 AI system impact assessment","note":"Original editorial mapping.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"satisfies","note":"Schedules the DPO, independent audit and periodic DPIA duties.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"ai-impact-assessment","title":"AI impact and fundamental-rights impact assessment","kind":"process","relationship":"supports","note":"Assessment content can be shared with the DPIA.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-impact-assessment"}],"url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties","policy":{"slug":"india-dpdp-act","title":"Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025","status":"partially_applicable","jurisdiction":"india","url":"https://aipolicytracker.org/policies/india-dpdp-act"}}