What Is This Module For?
The SDF Determination module helps you assess whether your organisation meets the criteria for designation as a Significant Data Fiduciary (SDF) under the DPDP Act 2023 — which triggers additional compliance obligations.
Which Law Requires This?
- DPDP Act 2023, Section 10 — The Central Government may designate certain Data Fiduciaries as Significant Data Fiduciaries based on volume and sensitivity of data processed, risk to data principals, national security considerations, and impact on sovereignty and integrity of India.
Additional SDF Obligations
If designated as an SDF, you must additionally: appoint an Indian-resident DPO, conduct annual DPIAs, conduct annual independent data audits, and not engage in algorithmic processing that could harm data principals.
Step-by-Step Guide
- Go to SDF Determination in the sidebar.
- Complete the SDF self-assessment questionnaire — enter your annual data volume, data categories processed, cross-border transfer volume, and business model.
- Review the risk indicators — dcomply flags your likely SDF status based on published criteria.
- Document your determination — whether you are or are not likely to be designated, with rationale.
- Review annually — SDF status can change as your business grows.
Common Mistakes to Avoid
- Assuming you are not an SDF because you are a startup — SDF designation is based on volume of data processed, not company size or age. A fast-growing fintech or healthtech can become an SDF within months.
- Not appointing an India-resident DPO proactively — Once designated as SDF, you must appoint a DPO resident in India under Section 10(2)(a). Waiting until after designation creates a compliance gap.
- Treating the SDF assessment as a one-time exercise — Monitor your data processing volumes quarterly. If you cross the threshold, self-report to the Data Protection Board rather than waiting to be designated.
- Confusing SDF obligations with standard fiduciary obligations — All data fiduciaries have obligations under the DPDP Act. SDFs have additional obligations (DPO, mandatory DPIA, annual audit). Track them separately.
Frequently Asked Questions
Q: Has the Government published a list of SDFs?
A: As of May 2026, no public list of designated SDFs has been published. Organisations meeting the criteria should proactively prepare for SDF compliance.