# DPDP Rules 2025, Rule 13: Significant Data Fiduciary duties

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-13-significant-data-fiduciary-obligations/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 13, Significant Data Fiduciary obligations

*(One secondary source numbers these obligations Rule 12; the corroborated numbering is Rule 13.
Verify before citing the rule number.)*

**(1)** Once in every period of **twelve months** from the date it is notified as an SDF, or
included in a notified class, undertake a **Data Protection Impact Assessment and an audit** to
ensure effective observance of the Act and Rules.

**(2)** Cause the person carrying out the DPIA and audit to **furnish a report to the Board**
containing significant observations.

**(3)** Observe **due diligence to verify that technical measures, including algorithmic
software**, adopted for hosting, display, uploading, modification, publishing, transmission,
storage, updating or sharing of personal data are **not likely to pose a risk to the rights of Data
Principals**. This is India's algorithmic accountability hook, and it is unusual: the Act itself
contains no automated-decision provision, so this duty exists only for SDFs and only via the Rules.

**(4)** Undertake measures to ensure that personal data **specified by the Central Government**, on
the recommendations of a **committee constituted by it**, is processed subject to the restriction
that **the personal data and the traffic data pertaining to its flow are not transferred outside
the territory of India**.

**(5)** Defines "committee" for the purposes of the rule.

**This is where localisation actually lives.** The Act's s.16 is a negative list and imposes no
localisation. Rule 13(4) creates a **targeted, committee-driven localisation mandate that applies
only to notified SDFs and only to categories of data the Government specifies**. Correct advice:
"DPDP does not mandate localisation generally; if your client is notified an SDF, Rule 13(4) may
localise specified categories once the committee acts; and sectoral regulators such as the RBI
already localise independently under Act s.16(2)."