ANVE: the private AI office, on the record. See what that means
ANVEPrivate AI glossary · updated 2026-10-07
Short answer. A significant data fiduciary (SDF) is a data fiduciary, or a class of them, that the Central Government notifies under section 10 of India’s Digital Personal Data Protection Act, 2023. The Government decides on factors including the volume and sensitivity of personal data, risk to people’s rights, the sovereignty and integrity of India, electoral democracy, security of the State and public order. An SDF must appoint a Data Protection Officer based in India who answers to its board, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Rule 13 of the DPDP Rules, 2025 makes the assessment and audit yearly and adds a duty to check that algorithmic software does not put people’s rights at risk. The Act names no SDFs itself. This is general information, not legal advice.
Section 10(1) lets the Central Government notify any data fiduciary or class of fiduciaries as significant, based on an assessment of factors it chooses, including these six:
| Duty | Source | Detail |
|---|---|---|
| Data Protection Officer | Section 10(2)(a) | Represents the SDF, is based in India, is responsible to the board of directors or similar governing body, and is the contact for grievances. |
| Independent data auditor | Section 10(2)(b) | Evaluates the SDF’s compliance with the Act. |
| Impact assessment and audit | Section 10(2)(c); rule 13(1) and (2) | Once in every twelve months from notification; the person who does it reports significant observations to the Data Protection Board. |
| Checks on algorithmic software | Rule 13(3) | Due diligence that technical measures, including algorithmic software, used to handle personal data are not likely to pose a risk to data principals’ rights. |
| Keeping specified data in India | Rule 13(4) | Personal data the Government specifies on a committee’s recommendation, and the traffic data about its flow, must not be transferred outside India. |
Rule 13(3) names algorithmic software expressly. An SDF that uses an AI model to read, sort or decide on personal data would be expected to show it checked that model for risks to people’s rights, such as uneven accuracy across languages, or answers that mix up two patients’ records.
Rule 13(4) matters for cloud AI: if the Government specifies a category of personal data, an SDF could not send it to a model hosted abroad. A model running on hardware in the office avoids that particular question. An appliance such as ANVE keeps processing on a device in the office, but an SDF would still need its own DPO, impact assessment and audit.
Breach of the additional obligations of an SDF under section 10 can attract a penalty of up to ₹150 crore (item 4 of the Schedule). Rule 13 comes into force eighteen months after the DPDP Rules were published in the Gazette dated 13 November 2025 (rule 1(4)).
This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.