s.10 · s.8 · Rule 9
Data Protection Officer
A Data Protection Officer is the individual a Significant Data Fiduciary must appoint under Section 10 to represent it under the Act, based in India and answerable to its board.
The DPO is the point of contact for the grievance redressal mechanism and reports to the board of directors or an equivalent body. The role is mandatory only for Significant Data Fiduciaries.
Every other Data Fiduciary has a smaller duty under Section 8(9): publish the business contact of a person able to answer a Data Principal’s questions about the processing. Rule 9 requires that contact to appear prominently on the website or app and in every response to a rights request. Many businesses name that person a grievance officer; the Act does not require the title.
Questions people ask
- Can the DPO be an external consultant?
- Section 10(2)(a) requires an individual who represents the Significant Data Fiduciary and is based in India; the Act does not require an employee. The Rules add that the DPO is responsible to the board.
- We are not a Significant Data Fiduciary. Do we need anyone?
- You need a published contact under Section 8(9) and a working grievance mechanism under Section 8(10). Whoever answers those is your person, whatever the title.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.