Significant Data Fiduciaries

In one line

The Central Government may notify a Data Fiduciary or class as significant on the basis of six listed factors and others it may determine, and a Significant Data Fiduciary must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out periodic impact assessments and audits.

Sub-section (1): the notification power and the six factors

"The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including"

• (a) the volume and sensitivity of personal data processed;
• (b) risk to the rights of Data Principal;
• (c) potential impact on the sovereignty and integrity of India;
• (d) risk to electoral democracy;
• (e) security of the State; and
• (f) public order.

Three observations.

The list is inclusive. "Such relevant factors as it may determine, including". So the six are examples, not limits.

Factor (a) reintroduces sensitivity through the back door. The Act has no category of sensitive personal data, chapter 1160, yet the sensitivity of the data is the first factor in deciding who bears the heaviest duties. So sensitivity is relevant to the regulatory tier, not to the substantive rules.

Factors (c) to (f) are not about data protection at all. Sovereignty and integrity, risk to electoral democracy, security of the State and public order are State-interest criteria. Their presence means that whether a company is a Significant Data Fiduciary is partly a political and security judgment, not simply a function of scale and risk to individuals.

And factor (d), "risk to electoral democracy", is unique to the Indian Act. It has no counterpart anywhere. It is aimed at platforms whose recommendation and advertising systems can affect elections.

The designation is by notification and there is no threshold in the statute. Compare the European Regulation, whose corresponding duties, the data protection officer under Article 37 and the impact assessment under Article 35, are triggered by objective tests applied by the controller itself, not by an executive designation.

Sub-section (2)(a): the Data Protection Officer

A Significant Data Fiduciary shall appoint a Data Protection Officer who shall

• (i) represent the Significant Data Fiduciary under the provisions of this Act;
• (ii) be based in India;
• (iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
• (iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act.

Three features, and each is a deliberate design choice.

Based in India. A localisation requirement, and the only one that survived from the earlier Bills, chapter 1190. A foreign platform must have a real person here.