A dangerous assumption has taken hold among many Indian businesses since the Digital Personal Data Protection (DPDP) Act, 2023 began rolling out: “We’re not a Significant Data Fiduciary, so we don’t really need to worry about this yet.” It’s an understandable mistake most of the compliance conversation in the media has centered on Significant Data Fiduciaries (SDFs), the large-scale processors facing India-based Data Protection Officers, mandatory audits, and algorithmic due diligence. But that framing leaves out a critical fact: the DPDP Act does not exempt ordinary data fiduciaries from compliance. Every organization that determines the purpose and means of processing personal data of individuals in India regardless of size, sector, or SDF status carries binding legal obligations from the moment the substantive provisions of the Act take effect. This guide breaks down exactly what applies to you if you are not, or not yet, classified as an SDF, and why treating baseline compliance as optional is a costly miscalculation.
A data fiduciary is any person or organization that, alone or together with others, determines the purpose and means of processing personal data. The threshold is deliberately low: a business that collects a customer’s name, email address, phone number or any other digital personal data of an individual in India is a data fiduciary under the Act. This applies equally to a five-person startup, a mid-sized software company and a multinational conglomerate.
The government designates certain data fiduciaries as “Significant” based on factors that include the volume and sensitivity of the personal data processed, the risk of harm to data principals, the potential impact on India’s sovereignty and integrity, the risk to electoral democracy, and the use of emerging technologies in processing. SDF status cannot be self-declared; it is assigned by the Central Government to specific entities.
SDFs are subject to a heightened layer of obligations on top of the baseline requirements applicable to every data fiduciary: appointing an India-based Data Protection Officer, engaging an independent data auditor, conducting annual Data Protection Impact Assessments, and periodically reporting significant findings to the Data Protection Board of India. Under the DPDP Rules, 2025, the compliance deadline is May 13, 2027, 18 months after their notification on November 13, 2025, and it applies to everyone. SDFs and ordinary data fiduciaries share exactly the same deadline: May 13, 2027. There is no later or more lenient timeline for non-SDFs, and the notion that data protection compliance can safely be deferred is therefore mistaken.
Regardless of whether the government ever designates an organization as an SDF, the following obligations apply, and each must be met by the same deadline of May 13, 2027.
Valid, Informed Consent
Personal data may be processed only on the basis of free, specific, informed, unconditional and unambiguous consent, or under one of the Act’s narrowly defined “legitimate uses”. Pre-ticked boxes, bundled consent and vague, catch-all language do not meet this standard.
Consent Withdrawal Must Be as Easy as Giving Consent
Data principals may withdraw consent at any time, and the Act requires that withdrawal be as easy as giving consent. Where a user can agree with a single click on a website or application, the user must be able to withdraw consent with comparable ease, without navigating multiple menus, submitting written requests or contacting a helpline. Once consent is withdrawn, the data fiduciary must cease processing the individual’s personal data and cause its data processors to do the same, unless the law requires or permits continued processing.
Clear Notice Requirements
Before or at the time of seeking consent, a data fiduciary must give the data principal a notice that describes the personal data being collected, the purpose of processing, and the manner in which the individual may exercise their rights and lodge a complaint. The notice must be written in clear, plain language and presented independently of any other information.
Reasonable Security Safeguards
Every data fiduciary must implement reasonable technical and organizational measures to prevent personal data breaches. The DPDP Rules, 2025 give this obligation concrete shape, pointing to measures such as encryption or masking of data, access controls including multi-factor authentication, and the retention of system logs for at least one year to enable the detection and investigation of incidents.
Data Principal Rights and Grievance Redressal
Individuals have the right to access, correct, update and erase their personal data, to nominate another individual to exercise these rights in the event of death or incapacity, and to file grievances. Data fiduciaries must maintain a readily accessible grievance redressal mechanism that responds within the prescribed timeframe.
Data Retention and Erasure Obligations
Personal data may be retained only for as long as it is needed for the purpose for which it was collected. Where the data principal withdraws consent, or the specified purpose is no longer being served, the data fiduciary must erase the personal data and ensure that its data processors do the same, unless retention is required by law. In practice, this requires clearly defined retention periods for each category of data, a process for deleting data when those periods expire or a valid erasure request is received, and the retention of the records and logs that the Rules prescribe, including system logs for at least one year.
Publishing Contact Details for Data Protection Queries
Every data fiduciary must publish, prominently on its website or application, the business contact details of a Data Protection Officer or another person who is able to answer data principals’ questions about the processing of their personal data. A Data Protection Officer is mandatory for SDFs, while other data fiduciaries may designate any suitably responsible person. The same contact details should appear in the privacy notice and be kept accurate and monitored, since an unanswered contact point undermines the grievance redressal mechanism.
Breach Notification Duties
Under Rule 7, every personal data breach must be reported, regardless of its size; there is no minimum threshold or materiality exemption. Breach notification operates in two stages. First, the Data Protection Board and every affected data principal must be notified immediately upon discovery of the breach, and individuals must be informed in plain language of what occurred, what data was affected and what protective steps they can take. Second, a detailed report must be submitted to the Board within 72 hours. The 72-hour window applies solely to this detailed report to the Board; it is not the deadline for notifying individuals.
Accountability for Data Processors
Where a data fiduciary engages a data processor to process personal data on its behalf, it must do so under a valid contract, and the fiduciary remains accountable for the processor’s actions. Careful selection and oversight of vendors is therefore integral to meeting a fiduciary’s own compliance obligations; it is not a means of transferring risk.
Cross-Border Data Transfer Rules
The DPDP Act permits personal data to be transferred outside India for processing, except to countries or territories that the Central Government restricts by notification. Any transfer must also comply with such additional requirements as the government may specify, and stricter requirements under other Indian laws, including sectoral rules for financial or health data, continue to apply. As the fiduciary remains accountable for data handled by its processors and cloud service providers, it should map where its data is stored and processed, including with offshore vendors, and ensure that its contracts and notices reflect those transfers.
Special Protections for Children’s Data
Any organization that processes the personal data of children must obtain verifiable parental consent and is prohibited from tracking, behavioral monitoring or targeted advertising directed at children. These obligations apply irrespective of SDF status.
Penalties Apply Regardless of SDF Status
This is the point that non-SDF organizations most often underestimate: the Schedule to the DPDP Act prescribes financial penalties that apply to any data fiduciary, not only SDFs. A failure to implement reasonable security safeguards that results in a personal data breach can attract a penalty of up to ₹250 crore. A failure to notify the Board or affected individuals of a breach can attract a penalty of up to ₹200 crore, and violations involving children’s data carry the same ceiling. Only the ₹150 crore penalty tied specifically to SDF obligations requires SDF status; every other major penalty category in the Schedule applies in full to ordinary data fiduciaries.
Organizations that are not SDFs should still treat compliance as a present-day priority rather than a future contingency. The following steps are recommended:
SDF status determines whether you need an India-based DPO, an independent auditor, and annual impact assessments — but it has never determined whether the DPDP Act applies to you at all. Every organization processing personal data of individuals in India is a data fiduciary from day one, carrying real obligations around consent, notice, security, breach response, and data principal rights, backed by penalties that reach into the hundreds of crores regardless of size or SDF designation. The businesses that treat “we’re not an SDF” as a reason to wait are the ones most likely to be caught unprepared when enforcement begins in earnest. The safer, and ultimately less costly, path is to build baseline compliance now.
This FAQ seeks to answer some of the most common questions and confusions about this topic.
Yes. Every data fiduciary, regardless of SDF status, must meet baseline obligations relating to consent, notice, security safeguards, breach notification, data retention and erasure, cross-border transfers, and data principal rights, all by the same deadline of May 13, 2027.
The Central Government designates SDFs on the basis of factors such as data volume, sensitivity, risk of harm, and impact on sovereignty, democracy or national security. It is not a matter of self-assessment.
SDFs must appoint an India-based Data Protection Officer, engage an independent auditor, conduct annual Data Protection Impact Assessments, and report significant findings to the Data Protection Board.
Yes. The highest penalty tier, up to ₹250 crore for failure to implement reasonable security safeguards, applies to any data fiduciary, not only SDFs.
The deadline is May 13, 2027, 18 months after the notification of the Rules on November 13, 2025. It applies to everyone: SDFs and ordinary data fiduciaries share exactly the same deadline, and there is no separate or earlier timeline.
Begin by mapping what personal data is collected and where it flows, then rebuild consent and notice mechanisms to meet the standards of the Act, before addressing security safeguards and breach response planning.
Yes. Every data breach must be reported, regardless of size. Both the Data Protection Board and the affected individuals must be notified immediately; the 72-hour window applies only to the detailed report to the Board, not to the notification of individuals.
