Organizations notified as Significant Data Fiduciaries (SDFs) must meet additional compliance requirements because they process large volumes or sensitive categories of personal data.
Under Section 10, they are required to appoint a Data Protection Officer based in India, engage an Independent Data Auditor, and conduct periodic Data Protection Impact Assessments (DPIAs). They may also need to implement additional measures prescribed by the Central Government based on their level of risk.
