Skip to main content

Q1 - What criteria are used by the government to notify an organization as a Significant Data Fiduciary (SDF)?

The Central Government has the discretion to classify a Data Fiduciary as a Significant Data Fiduciary based on:

  • The volume and sensitivity of personal data processed.
  • The risk of harm to individuals’ rights in case of misuse or breach.
  • The potential impact on sovereignty, integrity, electoral democracy, or public order in India.
  • The scale of profiling activities, especially those using AI or algorithms that may influence behavior.
Example

A national telecom operator handling call records and location data of 250 million customers is highly likely to be declared an SDF.

In contrast, a regional hospital with 50,000 patient records, though sensitive, may not meet the scale to qualify as an SDF.