Meeting Significant Data Fiduciary obligations

The board meeting where the question comes up

A payments company in Bengaluru processes UPI transactions for a few crore users. Its lending partner runs a credit scoring model on the same customer base, and its support desk holds years of chat transcripts. At a board meeting, an independent director asks a simple question: if the government names us a Significant Data Fiduciary, what changes, and how long would it take us to be ready?

Nobody in the room can answer it with confidence. The privacy lead knows the duties exist, and the CTO assumes they are mostly paperwork.

How a company becomes significant

Designation comes from the government

A company does not adopt this status for itself. The Central Government notifies a Data Fiduciary, or a class of Data Fiduciaries, as significant, and the notification is what brings the additional duties into effect.

The Digital Personal Data Protection Act, 2023 sets out the factors behind that decision: the volume and sensitivity of the personal data processed, the risk to the rights of the people it belongs to, the potential effect on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order.

Reading that list tells a company something useful about its own position. A payments platform holding financial records for millions of people, or a social app whose recommendations shape what people see, sits in different territory from a regional manufacturer holding employee records.

No company should assume it will never be notified, and none should treat notification as imminent without a reason. A company close to any of those factors does well to understand the additional duties before a notification arrives.

Why preparing ahead of designation makes sense

The additional duties go well beyond adjusting existing practice. They introduce a named officer, an independent audit, a yearly assessment and a review of algorithmic software, and each of those takes time to set up properly.

A company that treats the notification as the moment to begin finds itself recruiting, procuring an auditor and running a first assessment cycle all at once.

Most of these duties are also good practice for any company handling large volumes of personal data. A company with a yearly assessment and a named privacy officer stands in a stronger position whether or not the notification ever comes.

What is at stake and when

The Schedule to the Act allows a penalty of up to 150 crore rupees for breach of these additional obligations, with the Board deciding the actual amount. The DPDP Rules, 2025 were notified on 13 November 2025 and bring these duties into force around 13 May 2027; check for later amendments before fixing a plan against that date.

The Data Protection Officer

What the Act asks of the role

A Significant Data Fiduciary has to appoint a Data Protection Officer who represents it under the Act, who is based in India, who is an individual responsible to the board of directors or a similar governing body, and who is the point of contact for the grievance redressal mechanism.

The officer has to be in India, so the role cannot sit with a group privacy function abroad. The officer answers to the board, which places the role above the operational layer and gives it standing. And the officer is the contact point for grievances, so the role has a public face that individuals can reach.

The reporting line is the part companies find hardest to arrange, because it cuts across their normal structure. A privacy officer who reports to the CTO sits inside the function whose work they may need to challenge. A line to the board is how the role gets its independence, and agreeing it usually takes several rounds of discussion.

TrustOS supports the role by giving the officer the view of the programme that the Act implies: open obligations across the company, items with no owner, reviews that have slipped, exceptions that are piling up, and how requests and grievances are being handled. An officer who answers to the board needs a position they can state to it.

The grievance route and its records

Because the officer is the contact point for grievances, the grievance mechanism becomes part of the role. It stops being something operations handles on the side. A Data Principal who is unhappy has to exhaust that mechanism before approaching the Data Protection Board, and the Rules expect grievances to be answered within a period you publish, of no more than 90 days. The quality of the mechanism therefore decides whether a complaint escalates.

TrustOS records each grievance with its intake, assignment, investigation, response and closure, and the officer can see the whole set. A run of similar grievances usually points at a process that needs changing.

The record also supports the officer when a matter does reach the Board. A company that can show what the person asked, when, what was investigated and what was said in reply is answering from evidence.

The yearly impact assessment

From working tool to obligation

For a company outside the significant category, a Data Protection Impact Assessment is a working tool, used where the risk warrants it. For a Significant Data Fiduciary it becomes a duty: under the Rules, the assessment and an audit are carried out once every twelve months.

That changes what the assessment has to be. A discretionary assessment can be scoped to the processing that worries the company most. A yearly duty has to cover the processing the company actually carries out.

The assessment describes the processing, weighs the risk to the people whose data is involved, considers the measures available to reduce that risk, and settles the controls the processing will run under. Those controls then become requirements the systems have to meet.

TrustOS holds the assessment against the processing activities it covers, and turns each resulting control into assigned work with an owner and a due date. A finding that a data flow needs stronger protection, such as masking account numbers in a reporting store, reaches a technology owner. A finding that a retention period is too long changes the retention rule.

Why the yearly cycle needs the inventory

An assessment that covers the processing a company carries out depends on knowing what that processing is. A company without a purpose register and a data inventory has to build both before it can assess anything, and doing that inside the assessment cycle stretches the cycle well past its natural length.

Companies that already keep those records find the yearly assessment becomes a review of what changed since the last one: new purposes, processors, data flows and volumes.

Companies without them find the assessment becomes a discovery project every year, because the previous year's work was never captured in a form the next year could build on. TrustOS keeps each assessment linked to the records it was based on, so the next cycle starts from the current position.

The independent audit

What an independent auditor examines

A Significant Data Fiduciary has to appoint an independent data auditor to evaluate its compliance with the Act. Independent here means outside the company, and the appointment is a procurement exercise with its own calendar.

An auditor examines whether the controls the company describes actually operate. They will pick a sample of rights requests and follow each one through. They will ask for proof that retention rules ran last quarter. They will check whether processor reviews happened on the dates claimed. They will look for decisions taken without any recorded reasoning. Companies that keep their documentation apart from their operations usually have a gap they did not know about, and an auditor finds it quickly, because they ask for records.

A company running its obligations through TrustOS can answer those requests from operating records. The guide on preparing evidence for review and audit covers what an audit package contains and how to put one together.

Reporting significant observations

The Rules require the person carrying out the assessment and audit to furnish a report of significant observations to the Data Protection Board. That brings the audit into the governance of the company. It can no longer sit as a document filed with the privacy team.

An observation reported and left unremediated will be visible in the next cycle, so each finding and the work it generates have to stay connected.

TrustOS holds audit findings with their remediation actions, owners and completion dates. When the officer reports to the board, the report can say what was found, what has been fixed, what is still open and when it will close. A report of that kind carries far more weight than a list of findings with no status against them.

Algorithmic due diligence and transfers

Checking that algorithmic software does not put people at risk

A Significant Data Fiduciary has to observe due diligence to verify that the technical measures it adopts, including algorithmic software used to host, display, store or share personal data, are not likely to pose a risk to the rights of Data Principals.

The duty reaches a wide range of systems. A credit scoring model, a fraud score on transactions, a ranking system on a marketplace, content moderation, and a recommendation feed on an edtech app all process personal data in ways that can affect people.

Due diligence here means a written review of what the system does with personal data, what outcomes it produces, what could go wrong for an individual, and what controls limit that risk. It needs repeating whenever the system changes materially.

TrustOS keeps an algorithmic system risk review for each system, with its date, owner and the controls it produced, alongside an AI processing register that lists where automated processing touches personal data. A company asked how it meets this duty can point to reviews with dates and owners.

Restrictions on transfers

Section 16 of the Act lets the government restrict the transfer of personal data to countries or territories it notifies. The Rules go further for a Significant Data Fiduciary: it has to make sure that personal data specified by the government, on the recommendation of a committee, is processed subject to the restriction that it is not transferred outside India. Where a restriction applies, the company has to know where its data actually goes.

That knowledge comes from the data movement records described in the guide on mapping the personal data you hold. A company that has not mapped its outbound flows will be investigating its own architecture against a deadline.

TrustOS records the destination of each flow alongside the processors involved, so a restriction can be checked against the actual position. Where a flow falls within a restriction, the platform creates the work to address it and keeps the record of what was done.

Governance, and where to begin

What ties the additional duties together

Read as a set, the additional duties describe a governance arrangement more than a list of tasks. An officer with standing and a line to the board. A yearly assessment covering the processing that actually happens. An independent check on whether controls operate. Significant observations reported upward. Algorithmic systems reviewed. Transfers known and controlled.

TrustOS supports the arrangement by producing the position from the operating records. Board reporting becomes a view you open, where it used to be a quarterly assembly exercise. TrustOS records the decisions and the evidence. Whether a duty is met, and how the Act applies to your facts, remains a matter for your legal advisers.

Preparing without a notification

A company that considers designation plausible has a sensible order of preparation:

1. Build the inventory and purpose list first. The assessment and the transfer duties both depend on them.
2. Name the officer and settle the reporting line. Do it before the law requires it, so the board gets used to hearing from the role.
3. Run one assessment at small scale. Pick the processing with the most risk, such as the credit model or the patient records system, and learn what the exercise involves.
4. Review the algorithmic systems. Many companies find this the most useful step of all, designated or not, because it raises questions nobody asked when the systems were built.
5. Bring in the auditor last. An auditor looking at an immature programme produces a long list of findings you already knew about. Get the basics working first, and the audit tells you something new.

The Significant Data Fiduciaries guide sets out the legal text behind each of these duties.