4

Additional obligations of a Significant Data Fiduciary

Undertake a Data Protection Impact Assessment and an audit at least once every twelve months and report the significant observations to the Board. Verify that algorithmic software used for processing does not pose a risk to Data Principals' rights. Observe restrictions on transferring specified personal data outside India.

← R.11R.13 →Open the module
Rule 12DPDP Rules, 2025Significant Data FiduciaryUp to ₹150 Cr
What this requires

Undertake a Data Protection Impact Assessment and an audit at least once every twelve months and report the significant observations to the Board. Verify that algorithmic software used for processing does not pose a risk to Data Principals' rights. Observe restrictions on transferring specified personal data outside India.

Evidence a regulator would accept

  • Annual DPIA report
  • Annual audit report
  • Algorithmic due diligence record
  • Board submission acknowledgement

How this product discharges it

dpia (primary)assessmentdpo
Our position

Changing this recalculates the readiness score immediately.

Current
Gap
Residual risk
Critical
Owner
Meera Iyer
Last reviewed
10 Apr 2026
Next review due
18 Feb 2027

Open gaps (2)

Gaps raised against this obligation. Closing one moves this clause forward.

Evidence (1)

Documents indexed against this obligation in the evidence vault.

History

  1. Clause status updated following remediationyesterday
    06 Aug 2026, 00:30Deepika Joshi
  2. Clause status updated following remediation4 days ago
    03 Aug 2026, 17:30Rohit Verma
  3. Clause status updated following remediation6 days ago
    01 Aug 2026, 10:30Naveen Kulkarni
  4. Clause status updated following remediation8 days ago
    30 Jul 2026, 06:30Vikram Saxena
  5. Clause status updated following remediation10 days ago
    28 Jul 2026, 00:30Imran Sethi
  6. Clause status updated following remediation13 days ago
    25 Jul 2026, 16:30System
  7. Position reviewed and recorded4 months ago
    10 Apr 2026, 11:55Meera Iyer

Related obligations