Consent Docs
Open console

Meet the duties of a Significant Data Fiduciary

Mark the project as a Significant Data Fiduciary, keep the yearly assessments and audits, and download the report for the Data Protection Board.

How-to3 min readFor project administrators and deployment operators

Use this page when the Central Government notifies your business, or a class it belongs to, as a Significant Data Fiduciary. The project then records what section 10 of the DPDP Act and Rule 13 add, and the DPDP Act check tests it.

Before you start#

  • You are an Owner or a Privacy officer of the project. An Auditor can read the page and download the report, but cannot change it.
  • The Data Protection Officer is named in Project settings. See Change project settings.

Mark the project#

  1. Open Audit.
  2. Choose Significant Data Fiduciary.
  3. In Designation, turn on Notified as a Significant Data Fiduciary. The rest appears once it is on.
  4. Fill in Notified on and the Gazette notification.
  5. Turn on Based in India when the Data Protection Officer is based in India.
  6. In Answers to, name the board of directors or similar governing body.
  7. If the Government specified personal data that must stay in India, turn that on under Keeping data in India and describe the data.
  8. Choose Save.

Record an assessment or an audit#

The page keeps three registers: Data Protection Impact Assessments, Audits by an independent data auditor and Algorithmic due diligence.

  1. In a register, choose Add an assessment, Add an audit or Add due diligence.
  2. Fill in the Title, Carried out by and Firm or organisation.
  3. For an audit, keep Independent of the fiduciary on.
  4. Fill in the period, the Significant observations and, once it is done, Completed on.
  5. Under Report file, choose the report. Only its SHA-256 and name are kept. The file stays on your computer.
  6. When the report reaches the Board, fill in Reported to the Board on.
  7. Choose Add.

Next due is twelve months after Completed on unless you set it. Before the first entry, the first period ends twelve months after Notified on. An entry shows Due soon in the 30 days before it is due, and Overdue after. A completed entry cannot be removed, only corrected.

Download the report for the Board#

Under Rule 13(2), the person who carried out the assessment and the audit gives the Data Protection Board a report of the significant observations.

  1. Choose Download the report for the Board.
  2. Check Period from and Period to. They start as the current twelve-month period from the notification.
  3. Choose Download.

You get the report as JSON and as text ending with the JSON file's SHA-256, so the Board's copy can be checked. Each entry in it carries the SHA-256 of its report file. The download is written to the audit log.

What the DPDP Act check tests#

Once the project is marked, the check replaces its note on these duties with six checks, and a seventh while data must stay in India.

Check Met when
Data Protection Officer Named, based in India, and whom they answer to is recorded
Independent data auditor An audit names an independent auditor
Impact assessment One was completed in the last twelve months
Audit One was completed in the last twelve months by an independent auditor, and reported to the Board
Algorithmic due diligence One is completed
Data kept in India The deployment says it runs in India. A note when no data must stay
Partners in India When data must stay in India, each partner on Processors has India as its country. A warning names the others

The data check reads DEPLOYMENT_COUNTRY, which the operator sets. While the first period runs, a missing assessment or audit is a warning, not a failure.

↑↓ to move, Enter to open