Legal Register
RULE-13 Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Rule 13: Designation; algorithms; Government data specification
No KS, AUC, fairness-code or API threshold supplied here; correct Departments in (5).
Regulated Actor: Notified SDF; assessment/audit person; Central Government
Gazette Baseline: Lines 1276–1293
Subordinate Trigger
Designation; algorithms; Government data specification
Applies to: Notified SDF; assessment/audit person; Central Government
Rule Prescriptions
DPIA and audit once each twelve-month period from notification; significant observations report by assessor/auditor; algorithmic technical-measure diligence; specified data/traffic not abroad.
Exceptions & Provisos
Data restriction requires specification on committee recommendation; no general all-data localisation.
Official Gazette Text (Verbatim Rules Publication)
Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025.
13. Additional obligations of Significant Data Fiduciary. — (1) A Significant Data Fiduciary shall, once
in every period of twelve months from the date on which it is notified as such or is included in the class of
Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure
effective observance of the provisions of this Act and the rules made thereunder.
(2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment
and audit to furnish to the Board a report containing significant observations in the Data Protection Impact
Assessment and audit.
(3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including
algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission,
storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of
Data Principals.
(4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the
Central Government, on the basis of the recommendations of a committee constituted by it, is processed
subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred
outside the territory of India.
(5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of
this rule, which shall include officials from the Ministry of Electronics and Technology and may include
officials from other Ministries or Department of the Central Government.
Mapped Operational Controls (1)
Enterprise obligations in the Control Master Matrix implementing this subordinate rule.