Data protection · Provision

Section 10, DPDP Act 2023 — Significant Data Fiduciary Duties

Section 10, Digital Personal Data Protection Act, 2023

A data protection officer based in India, an independent auditor, and a periodic impact assessment, for those the Government notifies.

Quick Statutory Answer

Section 10 of the DPDP Act 2023 applies to a Data Fiduciary notified by the Central Government as a Significant Data Fiduciary, assessed on volume and sensitivity of data and on risks to rights, sovereignty, electoral democracy, State security and public order. It must appoint a Data Protection Officer based in India who answers to the governing body, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Breach carries up to ₹150 crore.

Check your compliance exposure — free All provisions

What the section does

  • The Central Government may notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary. The status is conferred by notification, not reached by crossing a number on its own.
  • The assessment takes account of the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State and public order.
  • A Significant Data Fiduciary must appoint a Data Protection Officer who is based in India, is responsible to the board of directors or equivalent governing body, and is the point of contact for grievance redressal.
  • It must also appoint an independent data auditor to evaluate compliance, and undertake periodic Data Protection Impact Assessment and periodic audit, along with such other measures as may be prescribed.

Section 10 DPDP Act — Additional Obligations of a Significant Data Fiduciary

Section 10 DPDP Act — Additional Obligations of a Significant Data Fiduciary
Obligation Requirement Applies To
Data Protection Officer Based in India, responsible to the board or equivalent, contact point for grievances Significant Data Fiduciary only
Independent data auditor Appointed to evaluate compliance with the Act Significant Data Fiduciary only
Data Protection Impact Assessment Carried out periodically Significant Data Fiduciary only
Periodic audit Carried out periodically Significant Data Fiduciary only
Duties under section 8 Security, accuracy, erasure, breach notice, grievance contact Every Data Fiduciary

Schedule ceiling

up to ₹150 crore. Breach of the additional obligations of a Significant Data Fiduciary is a separate head in the Schedule.

Where people go wrong

  • Assuming the status arrives automatically on reaching a volume. It is conferred by notification from the Central Government.
  • Appointing a data protection officer located outside India. The section requires one based in India who is responsible to the governing body.
  • Treating the independent auditor as the internal compliance team. The auditor is required to be independent.
  • Reading section 10 as the whole compliance burden. These obligations are additional to the duties every Data Fiduciary already carries under section 8.

Common questions

Who is a Significant Data Fiduciary under the DPDP Act?

One that the Central Government notifies as such, assessed on the volume and sensitivity of the personal data processed and on the risks to the rights of Data Principals, the sovereignty and integrity of India, electoral democracy, the security of the State and public order.

Does every business need a Data Protection Officer?

No. A DPO based in India is an additional obligation of a Significant Data Fiduciary under section 10. Every Data Fiduciary must, under section 8, publish the contact details of the person who answers questions about its processing.

What is a Data Protection Impact Assessment?

A periodic assessment a Significant Data Fiduciary must undertake under section 10(2)(c), alongside a periodic audit and any other measures prescribed.

Act on this

  • Section 8 — the duties every fiduciary carries
  • Section 33 — how the penalty is fixed
  • Free DPDP readiness check

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.