DPDP Act 2023 · Obligations

Section 10: Additional obligations for Significant Data Fiduciaries

What Section 10 says, in plain English

Once notified as an SDF, extra obligations: appoint an India-based DPO (10.2.a), independent audit (10.2.b), and DPIA + audit report to the Board periodically. Rule 12 adds algorithmic diligence.

What it means for you

SDF designation criteria in 10(1) look at volume, sensitivity, risk to data principal rights, electoral democracy, security, public order. Assume you might be designated if you operate at scale in BFSI, healthcare, edtech or social.

Other sections in Obligations

Section 4: Grounds for processing Section 5: Notice Section 6: Consent Section 7: Certain legitimate uses Section 8: General obligations of Data Fiduciary Section 9: Children's data

Also useful

All 44 sections DPDP vs GDPR Scan your site Ask a DPO (free)

← Section 9: Children's data All sections Section 11: Right to access information →