There's no '50 lakh users' rule for Significant Data Fiduciaries

The myth

You'll see confident claims online that you become a Significant Data Fiduciary (SDF) — with extra obligations like audits and a Data Protection Officer — once you cross "50 lakh users" or "₹250 crore turnover." Neither figure is in the law.

What the law actually says

Under section 10(1), the Central Government designates SDFs by notification, based on qualitative factors:

• the volume and sensitivity of personal data processed;
• risk to the rights of data principals;
• potential impact on the sovereignty and integrity of India;
• risk to electoral democracy, security of the State, and public order.

There is no automatic, number-based trigger. You become an SDF only if the government notifies you (or your class) as one.

Where the stray numbers come from

• "50 lakh users" is a real threshold — but it belongs to a separate online-gaming / data-retention context, not SDF designation.
• "₹250 crore" is the maximum penalty for a security-safeguards failure, not a turnover trigger.

What this means for you

Most SMBs will not be SDFs. Don't over-engineer to a threshold that doesn't exist — focus on the baseline obligations that apply to every data fiduciary.