Q2 - Once classified as an SDF, can a company appeal or challenge that designation?
The Digital Personal Data Protection Act, 2023 (DPDPA) does not provide a direct mechanism within Section 10 itself for challenging the Central Government’s decision to classify an entity as a Significant Data Fiduciary (SDF). However, the Act provides a general right of appeal under Chapter VII (Sections 29–30) that can be used to challenge orders or directions made by authorities under the Act, including those issued by or under the authority of the Central Government or the Data Protection Board of India.
1. Nature of SDF Notification
Under Section 10(1), the Central Government may notify any Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary based on factors such as:
- Volume and sensitivity of personal data processed,
- Risk to rights of Data Principals,
- Potential impact on sovereignty or public order, etc.
Such a notification is an executive decision taken through an official Gazette notification, meaning it applies by law once published.
2. Possibility of Appeal
Although the DPDPA does not explicitly describe an appeal process against SDF notification, a company may seek redress through the following paths:
a. Administrative Review / Representation
A company can make a representation to the Central Government requesting reconsideration or revocation of its classification, especially if:
- The company believes that the factors considered were inaccurate, or
- The scale or nature of its data processing has changed significantly.
The Government retains discretionary power under Section 10(1) to review or amend earlier notifications.
b. Appeal to the Appellate Tribunal
If the designation arises from or is linked to an order or direction issued by the Data Protection Board, the company can appeal under Section 29(1).
This section allows “any person aggrieved by an order or direction made by the Board under this Act” to appeal to the Appellate Tribunal (TDSAT) within 60 days of receiving the order. The Tribunal can confirm, modify, or set aside the decision.
c. Judicial Review by High Court
If the classification was made solely through a Government notification (not by the Board), the organization’s recourse would be judicial review under Article 226 of the Constitution of India.
The High Court can examine whether the classification violated principles of natural justice or lacked reasonable grounds.
3. Summary of Options
| Stage | Authority Involved | Applicable Provision | Type of Review |
|---|---|---|---|
| Step 1 | Central Government | Section 10(1) | Administrative reconsideration |
| Step 2 | Appellate Tribunal (TDSAT) | Section 29(1) | Appeal against Board’s order or direction |
| Step 3 | High Court (Judicial Review) | Constitutional remedy (Art. 226) | Legal challenge to Government notification |
A mid-sized data-analytics company is notified as a Significant Data Fiduciary due to its handling of large financial datasets. The company believes the classification overestimates its risk profile. It first files a representation to the Ministry of Electronics and IT (MeitY) requesting reconsideration. If rejected, and if the designation results in a Board order imposing new compliance directions, it may appeal that order to the Appellate Tribunal (TDSAT) within 60 days. As a final step, the company may approach the High Court for judicial review.
Referenced Provisions:
- Section 10(1) – Classification of Significant Data Fiduciaries.
- Section 29(1)–(4) – Right to appeal against orders or directions of the Board.
- Section 30 – Tribunal’s powers for enforcement.
- Article 226, Constitution of India – Judicial review of executive notifications.