Compliance
Complying with Section 10 of the DPDP Act means appointing an India‑based DPO, hiring an independent auditor, and carrying out periodic impact assessments and audits, with non‑compliance attracting penalties up to ₹150 crore under the Schedule.
Check your DPDP readiness — free More on the blogThe first practical step is to confirm that the Central Government has issued a notification naming your organisation, or the class of organisations you belong to, as a Significant Data Fidiciary. This status does not arise automatically from the amount of data you handle; it is granted by a formal government notice. Keep a copy of the notification in your corporate records and note the date of effect, as this triggers the additional obligations that follow.
Once notified, the board must designate a Data Protection Officer (DPO) who resides in India. The DPO reports directly to the board or equivalent governing body and serves as the single point of contact for data‑principal grievances. Draft a board resolution that records the appointment, outlines reporting lines, and specifies the DPO’s responsibilities. Update your public privacy policy to include the DPO’s name, address, and contact details, as required under the Act.
The next requirement is to engage an auditor who is independent of your internal compliance function. The auditor must have recognised credentials in data protection and must not be an employee or a consultant who also advises on your data practices. Issue a formal engagement letter that details the scope of the audit, frequency, and reporting obligations. Store the contract and auditor’s credentials for future reference.
Section 10 mandates a Data Protection Impact Assessment (DPIA) at regular intervals. Form a cross‑functional team – typically the DPO, a senior IT manager, and a legal officer – to map the volume and sensitivity of personal data you process, evaluate risks to data‑principal rights, and consider broader national concerns such as sovereignty or public order. Document the methodology, findings, and mitigation measures in a DPIA report that is signed off by the board.
Alongside the DPIA, the independent auditor must perform a comprehensive audit of your data protection controls. Prepare an audit checklist that mirrors the obligations in Section 10 and any prescribed measures. After the audit, the auditor issues a report highlighting compliance gaps and recommendations. The board should review this report, assign remediation tasks, and retain both the audit report and the remediation plan for inspection.
With the DPO, auditor, DPIA, and audit reports in place, revise your internal data‑handling policies to reflect the new obligations. Conduct mandatory training for all employees who handle personal data, focusing on the risk factors identified in the DPIA. Keep attendance logs and training materials as evidence of compliance, ready for any regulator request.
The Act allows regulators to request any of the documents you have created – the notification, DPO appointment letter, auditor contract, DPIA reports, audit findings, and policy updates. Compile these into a regulator‑ready folder, indexed by document type and date. Assign the DPO the responsibility to furnish the requested material within the stipulated timeframe, ensuring that the response chain is documented.
Finally, establish a monitoring routine to track any amendments to the DPDP Act or new government notifications that could affect your status. The DPO should review legal updates quarterly and advise the board on any required adjustments, preventing inadvertent non‑compliance and the associated penalty ceiling of up to ₹150 crore.
The status is confirmed only when the Central Government issues a formal notification naming the organisation or its class as a Significant Data Fiduciary. The notification must be retained in corporate records as it triggers the extra duties under Section 10.
Key documents include the government notification, the board resolution appointing an India‑based DPO, the independent auditor’s engagement letter, periodic DPIA reports, audit reports, updated data‑protection policies, and training attendance logs.
No. Section 10 requires the DPO to be based in India and to report directly to the board or equivalent governing body. Appointing an overseas DPO does not satisfy the statutory requirement and can lead to penalties.
Breaching the additional obligations of a Significant Data Fiduciary attracts a separate penalty head in the Schedule, with a ceiling of up to ₹150 crore. This amount is in addition to any other fines that may apply under the Act.
Published 11 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.