Rule 13 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 13(1) to (3) adds three duties for a Significant Data Fiduciary: a Data Protection Impact Assessment and an audit once in every period of twelve months, a report of significant observations to the Board, and due diligence that its technical measures, including algorithmic software, are not likely to pose a risk to Data Principals' rights.
Rule 13 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. A Significant Data Fiduciary undertakes a Data Protection Impact Assessment and an audit once in every period of twelve months, counted from notification; makes the person who carried them out furnish a report to the Board with significant observations; and verifies that its technical measures, including algorithmic software, are not likely to pose a risk to Data Principals' rights. Sub-rules (4) and (5) are covered separately.
Rule 13 and the Act
Section 10 of the Act lets the Central Government notify a Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, and section 10(2) lists additional obligations, including a Data Protection Officer, an independent data auditor and periodic Data Protection Impact Assessments. The Act's text is covered in Section 10 of the DPDP Act: duties of a Significant Data Fiduciary and notifying a Significant Data Fiduciary. Rule 13 adds the detail. Any notification of a Significant Data Fiduciary is to be made by the Central Government and none is in the Rules, so this article describes none.
Rule 1(4) places rule 13 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. See rules 1 and 2. Sub-rules (4) and (5), on personal data that may not leave India, are in our article on rules 15 and 13(4).
A company that might be notified can prepare ahead, and a legal due diligence review of its data systems is a sensible starting point.
Rule 13(1): assessment and audit every twelve months
"A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder."
| Element | Text |
|---|---|
| Who | A Significant Data Fiduciary |
| How often | "once in every period of twelve months" |
| From when | "from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such" |
| What | A Data Protection Impact Assessment and an audit |
| Purpose | "to ensure effective observance of the provisions of this Act and the rules made thereunder" |
Three points. First, the clock starts at notification, either of the Data Fiduciary itself or of its class. Second, it is "once in every period of twelve months", so the cycle repeats: one assessment and one audit in each twelve-month period. Third, the Rules do not define "Data Protection Impact Assessment" or say what it must contain. That is a gap in the text. The audit is tied to "effective observance" of the Act and the Rules.
Drafting slip: rule 13(1) says "the provisions of this Act and the rules made thereunder", while the Rules elsewhere refer to "the Act". It is quoted as printed.
Example (invented): MegaPay, a payments company, is notified as a Significant Data Fiduciary. In each twelve months from that date it carries out an impact assessment of its processing and commissions an audit of how it follows the Act and the Rules.
Rule 13(2): the report to the Board
"A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit."
The Significant Data Fiduciary does not itself file; it "shall cause the person carrying out" the assessment and audit to furnish the report. The content is "significant observations". The Rule does not say what is "significant", when the report is due or in what form. It does not name who may carry out the assessment and audit; the Act refers to an independent data auditor for the audit, but rule 13(2) simply says "the person carrying out".
Rule 13(3): diligence on technical measures and algorithms
"A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals."
The coverage is broad. The activities named are hosting, display, uploading, modification, publishing, transmission, storage, updating and sharing of personal data. The standard is "not likely to pose a risk to the rights of Data Principals". The Rules do not define "algorithmic software" or the "rights" at issue; the rights are those under the Act, covered in rights of a Data Principal under sections 11 to 14. The duty is to "observe due diligence to verify", which is a process: the Data Fiduciary should be able to show what it checked and when. Rule 13(3) says nothing about publishing the result.
Example (invented): VideoVista, a Significant Data Fiduciary, uses a recommendation algorithm that shares users' viewing histories with a partner analytics tool. Before relying on it, VideoVista verifies, and records, that the algorithm and the sharing are not likely to pose a risk to users' rights. The example is ours; the Rules contain no Illustration for rule 13.
Consequences and related duties
Rule 13 states no penalty; see the Schedule to the Act. An older, general post on special obligations of a Significant Data Fiduciary predates the Rules and should not be used for periods or steps. The report in sub-rule (2) goes to the Board, which has powers described in section 27. Whether and how the Board will use such reports is not in the Rules.
What is not in the Rules
The Rules do not list any Significant Data Fiduciary and do not say whether any has been notified; any such notification is to be made by the Central Government. Later amendments and notifications should be checked.
Need help preparing for Significant Data Fiduciary duties?
An impact assessment, an audit and an algorithm check are each easier if the data map and system inventory exist. Ask about legal due diligence to build that base before any notification.
Key takeaways
- Rule 13 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- A Significant Data Fiduciary undertakes a Data Protection Impact Assessment and an audit once in every twelve months from notification.
- It causes the person who carried them out to furnish a report of significant observations to the Board.
- It observes due diligence that its technical measures, including algorithmic software, are not likely to pose a risk to Data Principals' rights.
- The Rules do not define a Data Protection Impact Assessment or algorithmic software.
- Later amendments and notifications should be checked.
Read next
- Rules 15 and 13(4): transfer of personal data outside India
- Rule 6: reasonable security safeguards
- Section 10 of the DPDP Act: duties of a Significant Data Fiduciary
- Significant Data Fiduciary: special obligations
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.