Significant Data Fiduciary: Who Gets Designated, and What Actually Changes for a Bank or NBFC

Under Section 2(z) of the DPDP Act, a Significant Data Fiduciary is any Data Fiduciary or class of Data Fiduciaries designated as such by the Central Government under Section 10. The statute sets no fixed numeric thresholds.

Instead, Section 10(1) lets the Central Government notify an entity or a class of entities based on seven statutory factors:

1. Volume and sensitivity of personal data processed (Section 10(1)(a)): The scale of customer records and whether they involve sensitive categories such as financial records, biometric data, or identity documents.
2. Risk of harm to the Data Principal (Section 10(1)(b)): The potential for financial loss, identity theft, unauthorized profiling, or distress if personal data is breached or misused.
3. Potential impact on the sovereignty and integrity of India (Section 10(1)(c)): Exposure that could affect national security or strategic interests.
4. Risk to electoral democracy (Section 10(1)(d)): The potential for mass voter profiling, manipulation, or micro-targeting.
5. Security of the State (Section 10(1)(e)): Vulnerabilities in critical national infrastructure or core communication systems.
6. Public order (Section 10(1)(f)): The risk of systemic disruption, fraud-driven runs, or civil unrest.
7. Such other factors as may be considered necessary (Section 10(1)(g)): Residual discretion reserved for the Central Government.

Neither the DPDP Act, 2023 nor the DPDP Rules, 2025 published under G.S.R. 846(E) sets quantitative metrics, such as registered customer volume or transaction turnover. Designation remains an executive determination issued by official gazette notification.

Designation as an SDF does not replace baseline Data Fiduciary duties under Section 8. Instead, Section 10(2) of the Act and Rule 13 of the DPDP Rules, 2025 superimpose four additional statutory obligations:

The additional obligations under Section 10 and Rule 13 are not yet in force as of September 2026.

Under Commencement Notification G.S.R. 843(E) dated 13 November 2025, Section 10 of the DPDP Act commences in the eighteen-month tranche. Rule 1 of the DPDP Rules, 2025 (G.S.R. 846(E)) sets an identical eighteen-month trigger for Rule 13.

The computed date depends on the start day:

• Calculated from the 13 November 2025 gazette publication date: 13 May 2027.
• Calculated from 14 November 2025: 14 May 2027.

Neither instrument prints a calendar date. Both express the deadline as an elapsed period running from gazette publication.

Scheduled commercial banks, large NBFCs, and financial market infrastructures already operate under rigorous prudential and operational directions from the Reserve Bank of India. These include the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023.

While existing banking controls satisfy technical cybersecurity hygiene, an SDF designation introduces distinct statutory duties that do not map directly onto current banking frameworks:

For digital lenders, retail banks, and fintechs, Rule 13(3) represents the most significant operational expansion of compliance scope. BFSI institutions rely heavily on automated systems across their operational lifecycle:

• Automated credit scoring and loan origination engines.
• Machine learning models for real-time transaction monitoring and fraud detection.
• Alternative data analysis for customer underwriting and risk profiling.
• Biometric matching and liveness verification systems in digital KYC.

Under the Guidelines on Digital Lending issued by the RBI, lenders must disclose key underwriting parameters to borrowers upon request. However, Rule 13(3) establishes an affirmative obligation to conduct technical due diligence ensuring algorithms do not pose risks to Data Principal rights. This requires compliance teams to document:

1. Training data lineage and bias evaluations: Ensuring training sets do not embed discriminatory underwriting or credit denial factors.
2. Model explainability frameworks: Enabling customer grievance redressal when automated systems impact individuals.
3. Vendor risk assessments: Auditing third-party scoring algorithms and identity models embedded in customer onboarding pipelines.

Penalties for non-compliance under the DPDP Act are determined by the Data Protection Board of India under Section 33. The statute specifies statutory ceilings rather than fixed or per-instance penalties:

• Under Item 4 of the Schedule to the DPDP Act, 2023, a breach of the additional Significant Data Fiduciary obligations under Section 10 carries a penalty ceiling of up to ₹150 crore.
• In assessing quantum, Section 33 requires the Board to weigh statutory factors. These include the nature, gravity, and duration of the breach, the number of affected Data Principals, repetitive conduct, and any mitigating action undertaken by the entity.

The observations below represent this piece’s analysis of the statutory framework and regulatory texts cited above. While the statutory provisions carry legal force once commenced, the operational deductions drawn here are analytical.

DPO and CISO should be separate roles

On this piece’s reading, treating the DPO mandate as a title re-assignment for an existing CISO or legal counsel creates immediate governance friction.

• Under Section 10(2)(a), the DPO must report directly to the Board of Directors and act as the neutral point of contact for Data Principal grievances.
• A CISO, in contrast, is an operational executive. The CISO is tasked with network defense, system availability, and IT operations under the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023.

Combining these roles risks an operational conflict of interest. The same individual would evaluate data minimization and processing lawfulness, and would also be responsible for the uptime of data-consuming infrastructure.

Vendor models are now a Board-level risk

Rule 13(3) effectively shifts algorithmic governance from an internal IT testing convention into an audited statutory obligation. Banks and NBFCs often source fraud-scoring models, alternative scoring engines, and KYC verification pipelines from external RegTech and fintech vendors.

Financial institutions will therefore have to ask their technology partners for model auditability and risk assessments. Under Section 8(1), a Data Fiduciary remains liable for compliance regardless of any outsourcing contract. Third-party algorithmic verification is therefore a critical priority for Board risk committees.