Section 10 — the six factors the Government considers
Section 10 of DPDP gives the Central Government broad discretion to designate data fiduciaries as Significant Data Fiduciaries. The statute sets out six factors to be considered, though it does not prescribe weights or thresholds. Designation is by notification in the Official Gazette and may apply to individual organisations or classes of organisations.
- Volume and sensitivity of personal data processed: higher volumes and more sensitive categories (financial, health, biometric, children's data) increase designation likelihood
- Risk to the rights of data principals: if a breach or misuse would cause widespread financial, physical, reputational, or other harm at scale, the risk calculus tilts toward SDF
- Potential impact on sovereignty and integrity of India: platforms processing data that, if compromised, could affect national security, border management, or critical infrastructure
- Risk to electoral democracy: platforms with significant reach into voter populations or electoral communication channels
- Risk to security of the State: intelligence-adjacent data, sensitive government contractor data, or platforms used by critical public-sector entities
- Potential impact on public order: platforms whose disruption or data compromise could cause civil unrest, mass panic, or coordinated disinformation at scale