Rule 13, Significant Data Fiduciary obligations

(One secondary source numbers these obligations Rule 12; the corroborated numbering is Rule 13. Verify before citing the rule number.)

(1) Once in every period of twelve months from the date it is notified as an SDF, or included in a notified class, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and Rules.

(2) Cause the person carrying out the DPIA and audit to furnish a report to the Board containing significant observations.

(3) Observe due diligence to verify that technical measures, including algorithmic software, adopted for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data are not likely to pose a risk to the rights of Data Principals. This is India's algorithmic accountability hook, and it is unusual: the Act itself contains no automated-decision provision, so this duty exists only for SDFs and only via the Rules.

(4) Undertake measures to ensure that personal data specified by the Central Government, on the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow are not transferred outside the territory of India.

(5) Defines "committee" for the purposes of the rule.

This is where localisation actually lives. The Act's s.16 is a negative list and imposes no localisation. Rule 13(4) creates a targeted, committee-driven localisation mandate that applies only to notified SDFs and only to categories of data the Government specifies. Correct advice: "DPDP does not mandate localisation generally; if your client is notified an SDF, Rule 13(4) may localise specified categories once the committee acts; and sectoral regulators such as the RBI already localise independently under Act s.16(2)."