Rule 12ASignificant Data Fiduciary Obligations
Algorithmic due-diligence and data localisation
What the Rule sets out
Where algorithmic software is used for processing that could affect Data Principals, the Significant Data Fiduciary must undertake due diligence to verify it does not pose a risk to individual rights, and must comply with any Central Government direction restricting specified categories of personal data (and associated traffic data) from leaving India, based on the advice of a government-constituted committee.
What this means in practice
- If you run recommendation, scoring, or automated-decision systems at scale, document your model risk-assessment process now — this is squarely what future audits will ask for.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.