Rule 9
Contact information of the person answering questions about processing
Requires the contact details of the DPO, or of a person who can answer processing questions, to be published prominently and repeated in every rights-request response.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- 01
- Every Data Fiduciary must prominently publish on its website or app, and mention in every response to a communication from a Data Principal exercising her rights, the business contact information of the Data Protection Officer where applicable, or of a person able to answer questions about the processing of personal data.
In practice
Prominently is doing work here: a generic support address in a footer is not the same as publishing a named contact for processing questions. This is also one of the few obligations a scanner can check from outside the building, which is why its absence shows up so often on firms that otherwise look compliant.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 9 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.