Use this three-step filter to determine if your organization qualifies as a Significant Data Fiduciary (SDF) under DPDPA Section 10.
Step 1: The government assesses data volume and sensitivity millions of users, health/financial data, or services impacting democracy, national security, and public order.
Step 2: They can designate either a specific company or an entire sector (like all social media platforms or payment aggregators) as SDF.
Step 3: A public gazette notification formally declares SDF status only then do extra obligations kick in, including appointing a DPO, independent auditors, yearly DPIAs, and localization requirements.
If you're not on that list, consider yourself fortunate but core DPDPA compliance still applies.