June 20, 2026 · DPDP Help Center
Significant Data Fiduciaries: Start Your DPIA, Audit and DPO Now
With full compliance due by 13 May 2027, organisations likely to be notified as SDFs should begin DPIAs, independent audits and appointing an India-based DPO.
Large data processors that expect to be notified as Significant Data Fiduciaries (SDFs) face the highest compliance burden under Rule 13. Ahead of the 13 May 2027 deadline, readiness steps include:
- Conducting an annual Data Protection Impact Assessment (DPIA);
- Commissioning an annual independent data-protection audit;
- Appointing an India-based Data Protection Officer (DPO) reporting to the board;
- Performing due diligence on algorithmic systems and observing any cross-border data restrictions.
Early preparation reduces the risk of penalties of up to Rs 250 crore for security failures.
significant data fiduciary, sdf, dpia, audit, dpo, readiness