Module 9 of 9Section 107 min including the detail
Significant Data Fiduciaries, the Board and the money
The Act's heaviest duties fall on organisations the Government names, and its penalties are assessed against what you can show rather than what you intended.
You are a Significant Data Fiduciary when you are told you are
It is a designation, not a threshold you cross. So you cannot know in advance, which is the whole argument for being ready.
What the Government weighs
- Volume and sensitivityof the personal data processed
- Risk to rightsof Data Principals
- Sovereignty and integrityof India
- Risk to electoral democracy
- Security of the Stateand public order
The detail, if you want it
The Government may notify any Data Fiduciary or class of them as Significant, having regard to factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential effects on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order.
It is a designation, not a threshold you cross on your own. The practical consequence is that you cannot know in advance, so an organisation processing at scale should be able to meet these duties before being asked to.
Three additional duties
A DPO based in India answerable to the board, an independent auditor, and periodic impact assessments. None can be produced quickly.
The three
- Data Protection Officeran individual, based in India, responsible to the board
- Independent data auditorappointed to evaluate compliance
- Periodic DPIA and auditplus other measures the Rules prescribe
The detail, if you want it
A Significant Data Fiduciary must appoint a Data Protection Officer who is based in India, is an individual responsible to the board or equivalent governing body, and is the point of contact for the grievance mechanism. Based in India and answerable to the board are both explicit, and both rule out the common arrangement of a group DPO in another country.
It must appoint an independent data auditor to evaluate compliance. And it must undertake periodic Data Protection Impact Assessments and periodic audits, and observe such other measures as the Rules prescribe. Breach of these carries up to ₹150 crore.
How the money actually works
The ceilings are maximums, not tariffs. What decides the number is what you had in place before the incident and how fast you moved after.
- No reasonable security safeguards250
- Failure to notify a breach200
- Children's obligations200
- Significant Data Fiduciary duties150
- Residuary, any other breach50
The detail, if you want it
The Data Protection Board determines penalties having regard to the nature and gravity of the breach, the type of data affected, whether it is repetitive, whether gain or loss followed, what mitigation was taken and how promptly, and whether the penalty is proportionate and effective.
Read that list as an instruction. Two organisations with the same incident can be treated very differently on the basis of what they did before it and how fast they acted after. The Schedule sets the ceilings: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach, up to ₹200 crore for children's obligations, up to ₹150 crore for Significant Data Fiduciary duties, and up to ₹50 crore as the residuary penalty for other breaches. These are maximums, not tariffs, and not predictions of any fine.
The three things to remember
- Significant status is notified by the Government, not self-assessed, so you cannot know in advance.
- The DPO must be an individual based in India, responsible to the board.
- The Board weighs mitigation and how promptly you acted, so what you did before the breach decides the number.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A view on whether you would be designated, and a plan that does not begin on the day you are.
- If designated: a DPO in India answerable to the board, an independent auditor appointed, and a completed DPIA.
- Evidence of mitigation you could put in front of the Board, dated before any incident.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.