Data protection · Provision
A data protection officer based in India, an independent auditor, and a periodic impact assessment, for those the Government notifies. (Section 10, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Section 10 of the DPDP Act 2023 applies to a Data Fiduciary notified by the Central Government as a Significant Data Fiduciary, assessed on volume and sensitivity of data and on risks to rights, sovereignty, electoral democracy, State security and public order. It must appoint a Data Protection Officer based in India who answers to the governing body, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Breach carries up to ₹150 crore.
10. Additional obligations of Significant Data Fiduciary.— (1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including— (a) the volume and sensitivity of personal data processed; (b) risk to the rights of Data Principal; (c) potential impact on the sovereignty and integrity of India; (d) risk to electoral democracy; (e) security of the State; and (f) public order. (2) The Significant Data Fiduciary shall— (a) appoint a Data Protection Officer who shall— (i) represent the Significant Data Fiduciary under the provisions of this Act; (ii) be based in India; (iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and (iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act; (b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and (c) undertake the following other measures, namely:— (i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed; (ii) periodic audit; and (iii) such other measures, consistent with the provisions of this Act, as may be prescribed.
| Obligation | Requirement | Applies To |
|---|---|---|
| Data Protection Officer | Based in India, responsible to the board or equivalent, contact point for grievances | Significant Data Fiduciary only |
| Independent data auditor | Appointed to evaluate compliance with the Act | Significant Data Fiduciary only |
| Data Protection Impact Assessment | Carried out periodically | Significant Data Fiduciary only |
| Periodic audit | Carried out periodically | Significant Data Fiduciary only |
| Duties under section 8 | Security, accuracy, erasure, breach notice, grievance contact | Every Data Fiduciary |
up to ₹150 crore. Breach of the additional obligations of a Significant Data Fiduciary is a separate head in the Schedule.
One that the Central Government notifies as such, assessed on the volume and sensitivity of the personal data processed and on the risks to the rights of Data Principals, the sovereignty and integrity of India, electoral democracy, the security of the State and public order.
No. A DPO based in India is an additional obligation of a Significant Data Fiduciary under section 10. Every Data Fiduciary must, under section 8, publish the contact details of the person who answers questions about its processing.
A periodic assessment a Significant Data Fiduciary must undertake under section 10(2)(c), alongside a periodic audit and any other measures prescribed.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 10 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.