What extra obligations apply to Significant Data Fiduciaries?

Three main additions. An SDF must appoint a Data Protection Officer who is based in India and reports to the board of directors or equivalent governing body, and who serves as the point of contact for grievance redressal. It must appoint an independent data auditor to evaluate compliance. And it must undertake periodic Data Protection Impact Assessments and periodic audits, along with any other measures the Government prescribes, which may include restrictions on transferring certain personal data outside India.