Architecting Compliance Under India’s DPDP Act 2023: A Critical Examination of Significant Data Fiduciaries
Adv. Ishaan Sen
Principal Associate, Tech & Regulatory Practice
National Law School of India University (NLSIU), Bengaluru
This treatise dissects the statutory duties imposed upon Significant Data Fiduciaries (SDFs) under Section 10 of the Digital Personal Data Protection Act, 2023. By scrutinizing mandatory Data Protection Officers, Data Auditors, and cross-border transfer limitations, the author evaluates the operational readiness of Indian enterprises against the penal regime of up to ₹250 Crores.
1. Introduction: The Dawn of Codified Privacy in India
The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a historic departure from the stopgap framework of Section 43A of the Information Technology Act, 2000. Codifying the fundamental right to privacy recognized in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the statute introduces a principles-based regime tailored for an economy approaching one billion connected citizens.
At the epicenter of this regulatory paradigm lies the classification of entities as Data Fiduciaries and the heightened category of Significant Data Fiduciaries (SDFs) under Section 10.
2. Thresholds for Designation as a Significant Data Fiduciary
Under Section 10(1), the Central Government exercises wide statutory discretion to notify any Data Fiduciary or class thereof as an SDF based on:
3. Mandatory Governance Obligations for SDFs
Entities designated as SDFs face four non-negotiable statutory mandates:
3.1 Appointment of a Resident Data Protection Officer (DPO) Unlike standard compliance officers, the DPO under Section 10(2)(a) must be based in India, represent the point of contact for grievance redressal, and report directly to the Board of Directors.
3.2 Appointment of an Independent Data Auditor SDFs must retain external certified auditors to evaluate compliance posture, cryptographic safeguards, and consent lifecycle integrity annually.
3.3 Data Protection Impact Assessments (DPIA) Prior to initiating high-risk algorithmic processing or LLM model fine-tuning on personal datasets, SDFs must document risk mitigation strategies.
4. Penalties and Enforcement Mechanisms
The Data Protection Board of India (DPBI) is vested with civil court powers under Section 28. The penalty matrix set forth in the First Schedule is punitive:
| Violation | Maximum Statutory Penalty |
|---|---|
| Failure to adopt reasonable security safeguards to prevent data breach | Up to ₹250 Crores |
| Failure to notify Data Protection Board and Data Principal of breach | Up to ₹200 Crores |
| Non-compliance with additional obligations regarding Children's Data | Up to ₹200 Crores |
| Failure to observe duties of Significant Data Fiduciaries | Up to ₹150 Crores |
5. Conclusion & Forward-Looking Roadmap
The DPDP Act transforms corporate privacy from a tick-box legal exercise into a board-level fiduciary discipline. Indian enterprises must prioritize data mapping, automated consent revocation pipelines, and vendor risk assessments before the enforcement rules are formally gazetted.
Adv. Ishaan Sen
Principal Associate, Tech & Regulatory Practice • National Law School of India University (NLSIU), Bengaluru
Ishaan specializes in technology jurisprudence, privacy governance, and cross-border digital economy regulation.
Related Treatises in Data Privacy & Tech Law
View AllDecolonizing the Penal Code: Analyzing the Bharatiya Nyaya Sanhita (BNS) and its Impact on Criminal Justice
A structural comparison between the Indian Penal Code, 1860 and the Bharatiya Nyaya Sanhita, 2023. The paper explores the codification of community service, organized crime, terrorism provisions, and procedural safeguards under the Bharatiya Nagarik Suraksha Sanhita (BNSS).
Generative AI and Copyright Infringement: Deconstructing Fair Dealing Under Section 52 of the Indian Copyright Act
Does scraping publicly accessible copyrighted works for LLM pre-training constitute fair dealing under Indian law? This paper examines Section 52(1)(a) of the Copyright Act, 1957, juxtaposing US fair use doctrines against India’s closed-list statutory exemptions.
The Deal Value Threshold Paradigm: Scrutinizing the Competition (Amendment) Act 2023 on Big Tech M&A
An in-depth analysis of the Deal Value Threshold (DVT) of ₹2,000 Crore introduced by the Competition (Amendment) Act 2023. We examine how non-asset digital startups with substantial business operations in India are now captured in CCI’s mandatory merger notification dragnet.