Significant Data Fiduciaries: who they are and what they must do

How an organisation becomes one

There is no self assessment. The Central Government notifies a Data Fiduciary, or a class of them, as significant. The Act lets it consider factors such as the volume and sensitivity of the data, the risk to Data Principals' rights, possible impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order.

Large banks, insurers, telecom operators, hospital chains and big consumer platforms are the kind of organisations people expect to be considered. That is an expectation, and only a notification makes it so. Watch the MeitY site for notifications.

The additional duties

A Significant Data Fiduciary has every duty an ordinary Data Fiduciary has, plus the following.

• Appoint a Data Protection Officer based in India, who represents the organisation under the Act and is answerable to the board of directors or a similar governing body
• Appoint an independent data auditor to evaluate compliance with the Act
• Carry out a Data Protection Impact Assessment and an audit periodically, which the Rules set as once every year
• Do due diligence to check that algorithmic software used for processing personal data does not pose a risk to Data Principals' rights
• Follow any measures the government specifies on certain personal data and related traffic data, including where they must be processed

What the yearly cycle looks like

The DPIA and audit recur every year: you describe the processing, assess the risks to people, record how you manage them, and have an independent auditor check the result. The significant observations go to the Board.

For a hospital chain, that might mean assessing the patient app, the lab information system, the insurance claims desk and a new AI tool that reads scans, each with its own risks and owners.

When it applies

The Significant Data Fiduciary duties apply in Phase 3, around 13 May 2027 as notified, unless amended. They bite only once you have been notified. Breaching these additional duties can attract a penalty of up to 150 crore rupees.

Preparing if you might be notified

Start with the things that take time to set up: a DPO role with a clear reporting line, a budget and process for an independent auditor, and an inventory complete enough to support a DPIA. Algorithmic review is newer for most teams, so begin by listing which systems make or support decisions about people.

TrustOS supports DPIAs and processor assessments, keeps an AI processing register with algorithmic system risk review, and builds evidence packs an auditor can verify. The judgement about risk, and the audit opinion, stay with your people and your auditor, and TrustOS does not replace legal advice on your status.