37. 38. (3) The data protection officer shall meet the eligibility and qualification requirements to carry out its functions under sub-section (1) as may be specified. (4) Where any data fiduciary not present within the territory of India carries on processing to which the Act applies under section 2(2), and the data fiduciary is required to appoint a data protection officer under this Act, the data fiduciary shall appoint such officer who shall be basedin India and shall represent the data fiduciary in compliance of obligations under this Act. Processing by entities other than data fiduciaries. — (1) The data fiduciary shall only engage, appoint, use or involve a data processor to processpersonal data on its behalf through avalid contract. (2) The data processor referred to in sub-section (1) shall not further engage, appoint, use, or involve another data processor in the relevant processing on its behalf except with the authorisation of the data fiduciary, unless permitted through the contract referred to in sub-section (1). (3) The data processor, and any employee of the data fiduciary or the data processor, shall only process personal data in accordance with the instructions of the data fiduciary unless they are required to do otherwise under law and shall treat any personal data that comes within their knowledge as confidential. Classification of data fiduciaries as significant data fiduciaries. — (1) The Authority shall, having regard to the following factors, notify certain data fiduciaries or classes of data fiduciaries as significant data fiduciaries— (a) (b) (c) (d) (e) (f) volume of personal data processed; sensitivity of personal data processed; turnover of the data fiduciary; risk of harm resulting from any processing or any kind of processing undertaken by the fiduciary; use of new technologies for processing; and any other factor relevant in causing harm to any data principal as a consequence of such processing. (2) The notification of a data fiduciary or classes of data fiduciaries as significant data fiduciaries by the Authority under sub-section (1) shall require such data fiduciary or class of data fiduciaries to register with the Authority in such manner as may be specified. (3) All or any ofthe following obligations in this Chapter, as determined by the Authority, shall apply only to significant data fiduciaries— 22