Significant Data Fiduciary: the extra duties, including one about leaving India

Designation is made by the Central Government, having regard to factors including the volume and sensitivity of personal data processed, the risk to the rights of data principals, the potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. It is a designation you receive, not a threshold you self-assess against.

The additional duties are: a Data Protection Officer based in India and answerable to the board or equivalent; an independent data auditor; a Data Protection Impact Assessment and an audit once every twelve months, counted from the date of notification as a Significant Data Fiduciary, with whoever carries them out furnishing a report of significant observations to the Data Protection Board; and due diligence on technical measures including algorithmic software — satisfying yourself that algorithmic software used to process personal data does not pose a risk to data principals’ rights.

And the one that surprises people: an SDF must ensure that personal data specified by the Central Government — on the recommendation of a committee it constitutes — is not transferred outside India, together with the traffic data pertaining to its flow. India’s general position on outbound transfers is permissive; this is the carve-out, and it reaches only organisations that have been designated.