Understanding the additional obligations triggered once your organization crosses the SDF threshold.
The DPDP Act creates a heightened category of obligation for organizations notified as Significant Data Fiduciaries, based on factors like the volume and sensitivity of personal data they process.
How the threshold is determined
The government designates Significant Data Fiduciaries based on criteria including data volume, the risk to data principal rights, potential impact on India's sovereignty and electoral integrity, and the sensitivity of data processed.
What changes once you're designated
Significant Data Fiduciaries face additional obligations including appointing a Data Protection Officer based in India, designating an independent data auditor, and conducting periodic Data Protection Impact Assessments.
Preparing before designation
Because designation can happen with limited notice, organizations that are likely candidates — based on scale or sector — benefit from building these structures proactively rather than reactively.