The Central Government notifies an SDF under Section 10, based on: the volume and sensitivity of personal data processed; risk to the rights of Data Principals; potential impact on the sovereignty and integrity of India; risk to electoral democracy; security of the State; and public order. An organisation does not become an SDF on its own: it happens only through notification.