# Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits

- **Record type**: Obligation
- **Instrument**: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- **Jurisdiction**: India
- **Category**: impact_assessment
- **Binding**: Yes
- **Provision**: Section 10

## In brief

Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits is a legal requirement under the India DPDP Act in India (Section 10). The record carries 1 evidence example and mappings to 1 framework. In practice: Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.

## What the duty requires

Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protection Officer based in India, an independent data auditor, and periodically undertake data protection impact assessments and audits.

## What an organisation does about it

Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.

## Controls that meet this duty

- Privacy and data-protection controls for AI (satisfies): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- AI impact and fundamental-rights impact assessment (supports): https://aipolicytracker.org/controls/ai-impact-assessment

## Parent instrument

- Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
  - Record: https://aipolicytracker.org/policies/india-dpdp-act
  - Context file: https://aipolicytracker.org/policies/india-dpdp-act.md

## Provenance

- **Permanent id**: AIPT-OBL-0051 (https://aipolicytracker.org/id/AIPT-OBL-0051; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties
- **Official source**: https://www.meity.gov.in/data-protection-framework
- **Provision**: Section 10
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits (India DPDP Act)" [AIPT-OBL-0051, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0051 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.