Large digital platforms may eventually be classified as Significant Data Fiduciaries under India’s DPDP Act. But should they wait for a government notification before preparing? The answer is no. Early, proportionate preparation can reduce compliance risks without treating a possible designation as an existing legal obligation.
1. Size alone does not make a platform an SDF
The Digital Personal Data Protection Act, 2023 introduces the concept of a Significant Data Fiduciary (SDF) under Section 10.
The Central Government may notify a Data Fiduciary, or a class of Data Fiduciaries, as an SDF after assessing relevant factors. These include:
- The volume and sensitivity of personal data processed.
- The risk to the rights of Data Principals.
- The potential impact on India’s sovereignty and integrity.
- Risks to electoral democracy.
- Security of the State.
- Public order.
This is important because the Act does not prescribe a simple user-count, turnover or revenue threshold that automatically makes a company an SDF. A platform’s size or market position may be relevant, but designation requires government action under Section 10.
As of 11 November 2026, no public SDF designation notification or published list was identified in the official material reviewed. Therefore, a large platform should not describe itself as an SDF merely because it expects to fall within the Government’s assessment.
2. What additional obligations may follow designation?
Section 10(2) provides for additional obligations once a Data Fiduciary is designated as an SDF.
These include:
Appointment of an India-based Data Protection Officer: The SDF must appoint a DPO based in India. The officer must be responsible to the Board of Directors or an equivalent governing body and act as the point of contact for the grievance redressal mechanism.
Independent data auditor: The SDF must appoint an independent data auditor to evaluate its compliance with the Act.
Periodic assessments and audits: The SDF must undertake periodic Data Protection Impact Assessments (DPIAs) and audits. The statutory wording was also modified by the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, which substituted the words “data audit” in Section 10(2)(b).
Rule 13 of the DPDP Rules, 2025 adds further detail. It requires an SDF to undertake a DPIA and audit once in every twelve-month period from the date it is notified as an SDF or included in a notified class. Significant observations must be reported to the Data Protection Board.
Rule 13 also requires due diligence to verify that technical measures, including algorithmic software, are not likely to pose risks to Data Principals’ rights. It provides for restrictions on transferring specified personal data and related traffic data outside India, where the Central Government specifies such data.
These are additional SDF requirements, not obligations that every large platform automatically carries simply because of its size.
3. Why preparation should begin before designation
A platform processing millions of users’ records may operate through several products, subsidiaries, vendors, cloud systems and advertising or recommendation technologies. Identifying where personal data is collected, used, shared and stored can be a substantial exercise.
Waiting until a designation notification arrives may leave the organisation with limited time to understand its processing activities and establish accountability.
A better approach is to develop a readiness programme based on the risks and scale of the platform’s operations. Such preparation is a prudent governance measure; it should not be presented as an independent statutory SDF obligation before designation.
4. Five practical steps a large platform can take
First, create a reliable data inventory.
The platform should map the categories of personal data it collects, the purposes for which it processes that data, the systems in which it is stored, and the third parties with whom it is shared. This exercise should cover all major business functions rather than only the main consumer-facing application.
Second, identify high-risk processing activities.
Not all data processing presents the same level of risk. Large-scale profiling, behavioural advertising, location tracking, financial information and processing involving vulnerable individuals may require closer scrutiny. The platform can prioritise these activities for internal risk assessments.
Third, examine algorithms and automated systems.
Rule 13 specifically refers to technical measures, including algorithmic software. A platform should therefore understand how its recommendation engines, ranking systems, automated moderation tools and profiling technologies use personal data.
It can document their purposes, inputs, access controls, testing processes and potential effects on individuals. The objective is to identify and address risks to Data Principals’ rights, not merely to maintain technical documentation.
Fourth, establish an independent assessment framework.
The organisation can develop an internal DPIA methodology, maintain assessment records and identify suitable independent audit capabilities. It should also define how significant findings would be escalated to senior management and addressed.
This will make it easier to respond if formal SDF obligations become applicable.
Fifth, strengthen Data Principal rights and grievance processes.
Rule 14 of the DPDP Rules addresses the means through which individuals can exercise their rights, the identifiers required to process requests, and grievance redressal arrangements. A platform should design accessible processes for receiving, verifying, tracking and responding to requests.
Importantly, Rule 14 is not an SDF-only provision. It forms part of the wider framework applicable to Data Fiduciaries. Preparing these systems is therefore useful beyond the possibility of SDF designation.
5. What is the legal position on 13 November 2026?
The commencement schedule must be understood carefully.
Under the notified DPDP Rules, Rule 4, dealing with the registration and obligations of Consent Managers, is scheduled to commence one year after publication of the Rules. The Rules were published in November 2025, making 13 November 2026 the commonly stated commencement date.
However, the principal SDF framework under Section 10 of the Act and Rule 13 of the Rules falls within the eighteen-month phase, commonly calculated as commencing on 13 May 2027.
Rule 14, concerning Data Principal rights, is also in that eighteen-month phase. The precise commencement date should be read with the relevant Gazette notifications and corrigenda.
Accordingly, Rule 4’s commencement does not itself activate the SDF obligations under Section 10 or Rule 13.
Conclusion: Prepare for the possibility, not an assumption
A large platform does not need to wait for an SDF designation to improve its privacy governance. Data mapping, algorithmic risk reviews, grievance systems, internal DPIA processes and audit readiness can be developed in advance.
But there is an equally important legal distinction: readiness is not designation. Until the Central Government issues a notification covering the organisation or its class, it should not represent itself as an SDF or claim that SDF-specific obligations have already attached.
The sensible approach is to prepare early, monitor official notifications and build compliance systems proportionate to the organisation’s actual data-processing risks.
