(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including—

1. the volume and sensitivity of personal data processed;
2. risk to the rights of Data Principal;
3. potential impact on the sovereignty and integrity of India;
4. risk to electoral democracy;
5. security of the State; and
6. public order.

(2) A Significant Data Fiduciary shall—

1. appoint a Data Protection Officer who shall represent the Significant Data Fiduciary under the provisions of this Act and who shall be based in India;
2. appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
3. undertake the following measures, namely:—
   1. periodic Data Protection Impact Assessment;
   2. periodic audit; and
   3. such other measures, consistent with the provisions of this Act, as may be prescribed.