Big players, borders and exceptions
Significant Data Fiduciaries, cross-border transfers and exemptions
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Who becomes a Significant Data Fiduciary?
The Government names Significant Data Fiduciaries by notification, based on factors like these. It can name one business or a whole class.
There is no automatic numeric test. Large platforms, banks, telecom operators and health data processors are often discussed as likely candidates, but only a Government notification makes you an SDF. Watch the Gazette for SDF notifications, and prepare early if you are a likely candidate.
Extra duties for SDFs
SDFs carry extra duties. Missing them can cost up to ₹150 crore.
The data localisation duty applies only to personal data, and related traffic data, that the Government specifies on the recommendation of a committee. The algorithmic due diligence duty covers software used to host, display, upload, change, publish, transmit, store, update or share personal data.
Sending data abroad
Transfers abroad are allowed by default. The Government can restrict specific countries, and stricter sector rules, like RBI's payment data rules, still apply.
Rule 15 adds that transfers are subject to any requirements the Government sets about making data available to a foreign state or its entities. Check the Gazette for any list of restricted countries before relying on a transfer. Also track sector rules: RBI, SEBI, IRDAI and telecom licences may require local storage.
Exemptions: narrow and specific
Some activities are exempt from parts of the Act. Even then, you must still keep the data secure.
For the main s.17(1) exemptions, security safeguards (s.8(5)) and overall responsibility (s.8(1)) still apply. The startup exemption under s.17(3) can only relieve specific duties (notice, accuracy, erasure, SDF duties and access rights), and only once the Government notifies it.
In one line
Finally: how enforcement works, and a plan to get ready.