Section 10 Additional obligations of Significant Data Fiduciary
10. (1) The Central Government may notify any Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries as Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules..., on the basis of an assessment of such relevant factors as it may determine, including-
(a) the volume and sensitivity of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed;
(b) risk to the rights of Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf
(c) potential impact on the sovereignty and integrity of India;
(d) risk to electoral democracy;
(e) security of the State; and
(f) public order
(2) The Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... shall-
(a) appoint a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10 who shall-
(i) represent the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... under the provisions of this Act
(ii) be based in India
(iii) be an individual responsible to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of Directors or similar governing body of the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules...; and
(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
(b) appoint an independent dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means auditor to carry out dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means audit, who shall evaluate the compliance of the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... in accordance with the provisions of this Act; and
(c) undertake the following other measures, namely:-
(i) periodic DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection Impact Assessment, which shall be a process comprising a description of the rights of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals and the purpose of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of their personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, assessment and management of the risk to the rights of the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals, and such other matters regarding such process as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act;
(ii) periodic audit; and
(iii) such other measures, consistent with the provisions of this Act, as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.