For virtual DPOs and outsourced privacy officers
DPDP software for virtual DPOs and outsourced privacy officers
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
Under the DPDP Act only a Significant Data Fiduciary must appoint a Data Protection Officer; every other business must publish a person who can answer questions about its processing, and that is the role most virtual DPO services fill. Gevox runs that service across many clients at once: the contact published, the rights requests and their ninety-day clocks, the breach clocks, monthly monitoring and a report each month under your name.
From the Gevox Readiness Index: Across twenty DPDP advisor websites, the notice and the privacy contact were present on three in five. The visible obligations get done; the technical ones, consent before tracking and named processors, mostly do not.
What the Act actually requires of the role
Two duties are easy to blur. A Significant Data Fiduciary, once notified under Section 10, must appoint a Data Protection Officer: an individual based in India, responsible to its board of directors or similar governing body, and the point of contact for grievance redressal. No business has been notified yet.
Every Data Fiduciary, notified or not, must publish the business contact of a person able to answer questions about its processing, and mention it in every response to someone exercising a right, under Section 8 and Rule 9. It must also run an effective grievance mechanism. That person and that mechanism are what most businesses actually need, and what a virtual DPO service provides.
Whether an outside individual can serve as a Significant Data Fiduciary’s own Data Protection Officer is a question for that client’s counsel. Be precise in the engagement letter about which of the two roles you are taking on.
What the month looks like, per client
A retainer is billed against recurring work. For each client:
- Questions arrive at the contact you publish for them, and are answered.
- Rights requests are logged the day they arrive and answered within the ninety days Rule 14 allows, with acknowledgement, response and closing letters.
- Grievances are resolved before anyone approaches the Board, which Section 13 requires the individual to try first.
- If a breach happens, you are the first call: the affected people and the Board are told without delay, and the detailed report is due within seventy-two hours under Rule 7.
- The website is re-examined on a schedule, and the month ends with a report of what moved.
Running it for many clients
The work is not hard; the load is. Ten clients mean ten sets of clocks that never stop. In Gevox each client is a sealed workspace, and one list shows everything due this week across all of them: the request whose ninety days run out on Thursday, the breach whose seventy-two hours are counting, the monitoring report due on the first.
Published retainers for virtual DPO services in India start from around Rs 35,000 a month. On Suite the software cost is Rs 375 per client a month across 40 clients, and the monthly report carries your firm’s name, not ours.
Questions practitioners ask
- Does every company need a Data Protection Officer under the DPDP Act?
- No. Only a Significant Data Fiduciary notified under Section 10 must appoint one. Every Data Fiduciary must publish the business contact of a person able to answer questions about its processing, under Section 8(9) and Rule 9, and run a grievance mechanism.
- What does a virtual DPO do each month?
- Answers questions at the published contact, logs and answers rights requests within the ninety-day ceiling in Rule 14(3), resolves grievances, responds first to any breach under Rule 7, and reports to the client on what changed.
- Can I run several clients from one account?
- Yes. Each client is a sealed workspace in your account, and one list shows every deadline due across all clients this week.
- Can the reports go out under my name?
- Yes, on Suite and Firm. The monthly monitoring report and the gap assessment carry your firm’s name in place of Gevox.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.