Compliance
Section 10 of the Digital Personal Data Protection Act makes additional compliance obligations for entities the government labels as Significant Data Fiduciaries, and breaches can attract penalties up to the schedule ceiling of ₹150 crore.
Check your DPDP readiness — free More on the blogThe DPDP Act creates a baseline set of duties for every data fiduciary, but Section 10 adds a separate layer for those the Central Government notifies as Significant Data Fiduciaries. The status is not automatic; it is granted only through a formal notification after the government evaluates the entity’s data processing activities against specific risk criteria.
The notification process looks at the volume and sensitivity of personal data handled, the potential impact on the rights of data principals, and broader national concerns such as sovereignty, electoral democracy, state security and public order. Only after this assessment does the government issue a notice that confers the Significant Data Fiduciary label.
A Significant Data Fiduciary must appoint a Data Protection Officer (DPO) who resides in India, reports directly to the board or equivalent governing body, and serves as the single point of contact for grievance redressal. In addition, the entity must engage an independent data auditor, conduct periodic Data Protection Impact Assessments, and undergo regular audits as prescribed. These duties sit on top of the baseline requirements under Section 8, such as publishing a contact point for data queries. The independent auditor cannot be part of the internal compliance team; the law requires a third‑party evaluator to ensure objectivity.
If a Significant Data Fiduciary fails to meet any of the additional obligations, the breach is treated as a separate contravention in the penalty schedule. The maximum monetary penalty that can be imposed is capped at ₹150 crore, a figure that can be financially crippling for many small and medium enterprises. Businesses often mistake the notification as an automatic trigger when they cross a data‑volume threshold, leading to unexpected compliance costs. Similarly, appointing a DPO outside India or using an internal audit function instead of an independent auditor can expose the firm to the full schedule penalty. Understanding that the Significant Data Fiduciary label is a discretionary government decision helps firms plan their data governance structures proactively. If a notification is received, the firm must quickly align its organisational chart, hire a qualified India‑based DPO, contract an independent auditor and set up a schedule for impact assessments and audits. Failure to act promptly can result in enforcement actions that not only carry heavy fines but also damage reputation and erode customer trust. The cost of compliance—salary for a senior DPO, audit fees and assessment resources—should be weighed against the potential ₹150 crore penalty.
The Central Government issues a notification after assessing the entity’s data volume, sensitivity and the risks to individual rights, national sovereignty, electoral democracy, state security and public order. The status is not automatic based on any numeric threshold.
Section 10 specifically requires the DPO to reside in India so that the officer can be directly accountable to the board and act as the primary grievance contact within the country’s legal jurisdiction.
The auditor must be an external, independent party tasked with evaluating the entity’s compliance with the additional obligations of a Significant Data Fiduciary, including periodic audits and impact assessments, ensuring objectivity.
The ceiling represents the maximum fine for breaching the extra duties of a Significant Data Fiduciary. For small businesses, such a penalty can be existential, making early compliance planning essential to avoid potentially crippling financial loss.
Published 27 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.