top of page
Search

How to Commission the Independent Data Audit of a Significant Data Fiduciary

Writer: Kaustav Chowdhury
Kaustav Chowdhury
Oct 12
6 min read

Updated: 17 hours ago

Section 10 of the Digital Personal Data Protection Act, 2023 imposes two separate audit duties on a Significant Data Fiduciary, and the independent data audit is the one most often collapsed into the other. One is the appointment of an independent data auditor. The other is a periodic exercise the entity itself must undertake. Rule 13 of the Digital Personal Data Protection Rules, 2025 puts a twelve month clock on the second and sends its output to the Data Protection Board.

Step 1: Establish That the Entity Is Actually a Significant Data Fiduciary

This status is conferred, not assumed. Section 10(1) provides that the Central Government may notify any data fiduciary or class of data fiduciaries as a Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including the volume and sensitivity of personal data processed, the risk to the rights of data principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State and public order.

So the trigger is a notification, not a threshold the entity crosses on its own. A client that processes at scale is not a Significant Data Fiduciary until it is notified as one, either individually or as part of a notified class. The practical step is to monitor for the notification and to have the programme designed in advance, because the twelve month clock in rule 13 runs from that date.

Both provisions commence with the eighteen month tranche. Under the commencement notification G.S.R. 843(E) dated November 13, 2025, sections 7 to 17 come into force eighteen months after publication, and rule 13 sits in the matching group under the Rules notified by G.S.R. 846(E) of the same date, so these duties become operative in May 2027.

Step 2: Separate the Two Audit Duties Before Engaging Anyone

Section 10(2)(b) requires the Significant Data Fiduciary to appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of the Act. That is an appointment of a person with a defined mandate.

Section 10(2)(c) separately requires it to undertake other measures, namely a periodic Data Protection Impact Assessment, a periodic audit, and such other measures as may be prescribed. The Removal of Difficulties Order dated October 5, 2026 substituted data audit for audit in section 10(2)(c)(ii), so the periodic exercise is now expressly a data audit rather than an audit at large. Two duties, two scopes, and an engagement letter that serves one does not discharge the other.

Step 3: Test the Auditor's Independence Against the Mandate

The statute says independent and says data auditor, and both words do work. The mandate under section 10(2)(b) is to evaluate compliance with the Act, which means the auditor needs to be able to reach an adverse conclusion about the people who engaged it.

Record the independence test rather than asserting it. The obvious conflicts are an auditor who built the controls being asked to audit them, an auditor reporting to the function under review, and an auditor whose fee depends on the outcome. Note too that section 10(2)(a) requires the Data Protection Officer to be an individual responsible to the Board of Directors or a similar governing body, so the reporting line for the audit should not run through a person the audit may criticise.

Step 4: Start the Twelve Month Clock From the Right Date

Rule 13(1) requires a Significant Data Fiduciary, once in every period of twelve months from the date on which it is notified as such or is included in a notified class, to undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and the rules made under it.

The measuring date is the notification, not the financial year and not the date the auditor is engaged. Diarise it on the day the notification issues and work backwards, because a first cycle that overruns is visible on the face of the dates and cannot be cured by a later report.

Step 5: Build the Report to the Board Into the Engagement

Rule 13(2) requires the Significant Data Fiduciary to cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations. The obligation to procure the report sits on the entity, and the furnishing is done by the person who carried out the work.

Two drafting consequences follow. The engagement letter has to oblige the auditor to furnish that report, because the entity cannot discharge the duty without the auditor's cooperation. And significant observations is the reporting threshold, so the engagement should say how significance is to be judged and require the auditor to put the reasoning in the report rather than leaving the entity to argue about it afterwards.

Step 6: Add the Algorithmic Due Diligence

Rule 13(3) requires the Significant Data Fiduciary to observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of data principals.

This is a verification duty on the entity rather than a certification by the auditor, and the list of operations is wide enough to take in most of a production stack. Scope it into the same annual cycle, because an audit that reports on policies while the models are unexamined answers the wrong question.

Step 7: Deal With the Localisation Duty

Rule 13(4) requires the Significant Data Fiduciary to undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow are not transferred outside the territory of India. Rule 13(5) defines that committee as one constituted by the Central Government for the purpose of the rule, which shall include officials of the Ministry of Electronics and Information Technology.

Nothing bites until the Central Government specifies the categories, so the honest advice today is architectural readiness rather than relocation. Know which flows could be affected and what it would take to confine them, and record that analysis, because the duty extends to traffic data as well as to the personal data itself.

Common Pitfalls to Avoid

  • Self-designating as a Significant Data Fiduciary: Section 10(1) makes the status depend on a notification by the Central Government, individually or by class.

  • Running one engagement for both duties: Section 10(2)(b) is an appointment with a compliance evaluation mandate and section 10(2)(c)(ii) is a periodic data audit the entity undertakes.

  • Counting twelve months from the financial year: Rule 13(1) measures from the date of notification as a Significant Data Fiduciary.

  • Leaving the report to the Board out of the engagement letter: Rule 13(2) requires the entity to cause the person who did the work to furnish it, which it cannot do without a contractual obligation.

  • Auditing policies and not systems: Rule 13(3) extends due diligence to technical measures including algorithmic software across a wide list of processing operations.

  • Treating the localisation duty as live: Rule 13(4) operates on categories the Central Government specifies on a committee's recommendation, and none is specified yet.

  • Underweighting the exposure: The Schedule to the Act sets a penalty of up to Rs 150 crore for breach of the additional obligations of a Significant Data Fiduciary under section 10.

Key Statutory Provisions

  • Section 10 of the Digital Personal Data Protection Act, 2023: Notification as a Significant Data Fiduciary on an assessment of relevant factors; the appointment of a Data Protection Officer based in India and responsible to the governing body; the appointment of an independent data auditor to carry out data audit and evaluate compliance; and the periodic Data Protection Impact Assessment, periodic data audit and such other measures as may be prescribed.

  • The Schedule to the Act: A penalty of up to Rs 150 crore for breach of the additional obligations of a Significant Data Fiduciary under section 10.

  • Rule 13 of the Digital Personal Data Protection Rules, 2025: The twelve month cycle measured from notification; the duty to cause the person carrying out the assessment and audit to furnish a report of significant observations to the Board; due diligence on technical measures including algorithmic software; and the restriction on transferring specified personal data and its traffic data outside India, with the committee that recommends those categories.

Related in This Series

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page