For DPOs
For DPOs under DPDP
The DPDP Act makes a DPO mandatory only for Significant Data Fiduciaries. Many organisations appoint one anyway, and the job is the same: own the programme and prove it works.
Short answer
Under s.10(2)(a), a Significant Data Fiduciary must appoint a DPO who represents it, is based in India, is responsible to its Board of Directors or similar governing body, and is the point of contact for grievances. Outside SDFs, Rule 9 still requires publishing the business contact of a person who can answer questions about processing, and citing it in every response to a Data Principal. Core obligations begin on 13 May 2027.
What the law asks of a DPO
- For an SDF (s.10(2)(a)): represent the SDF, be based in India, be responsible to the Board of Directors or similar governing body, and be the point of contact for grievance redressal.
- For every fiduciary (s.8(9), Rule 9): publish the business contact of the DPO, or of a person who can answer questions about processing, on the website or app, and mention it in every response to a Data Principal.
- For an SDF (Rule 13): a DPIA and an audit every twelve months, significant observations furnished to the Board, and algorithmic due diligence.
s.10(2)(b) requires an SDF to appoint an independent data auditor. It is not the DPO.
Outside an SDF the title is optional, but the work is not. Someone must answer questions about processing, run grievances and lead the breach response.
What you own
- The register of processing activities and the ground for each.
- The published contact, and the request and grievance processes behind it.
- The breach response chain, with security and legal.
- Impact assessments for new or changed high-risk processing.
- Reporting to the Board of Directors on readiness, incidents and open risks.
What to do this quarter
- 01Publish your contact and periods
Put the Rule 9 contact on the website and app, and publish a grievance response period no longer than 90 days (Rule 14(3)).
- 02Agree your reporting line
Set a regular update to the Board of Directors, even before any designation. Our DPO appointment guide covers the terms.
- 03Stand up the request and grievance desk
One intake, identity checks before work starts, and a clock for each case.
- 04Test the breach chain
Run a drill to check you can intimate the Board and affected people without delay and file the detailed report within 72 hours (Rule 7).
Evidence to keep
- Records of processing and the ground for each activity.
- Notice versions and consent logs (s.6(10)).
- Request and grievance logs with dates and outcomes.
- Breach records, timelines and post-incident reviews.
- DPIAs, audit reports and Board of Directors minutes on privacy.
What to ask other teams
| Team | Ask |
|---|---|
| Security | Rule 6 control status, log retention, and who declares a breach. |
| Legal | Notice text, processor contracts and legitimate-use records. |
| Product | Every new purpose before it ships, and children's flows. |
| HR | Employee and candidate systems, vendors and retention. |
| Procurement | New vendors that will touch personal data, before signing. |
How TruePrivacy helps
- Data Principal requests and grievance redressal run every case against the 90-day outer limit, so you can close them sooner.
- The SDF workspace records the India-based DPO with an address in India and grievance contact, the independent data auditor, and yearly clocks once a designation is recorded.
- Breach management runs the Rule 7 clocks, and records of processing keep your register current.
- The DPDP checklist shows a posture score from live records as a readiness view, and the audit trail exports as CSV.
Is a DPO mandatory for every company?
No. s.10(2)(a) requires a DPO for Significant Data Fiduciaries. Other fiduciaries publish a contact for questions about processing (s.8(9), Rule 9).
Who does the DPO report to?
For an SDF, the DPO is responsible to the Board of Directors or a similar governing body (s.10(2)(a)).
Can an SDF's DPO be based outside India?
No. s.10(2)(a) requires the DPO to be based in India.
Is the DPO the same as the data auditor?
No. s.10(2)(b) requires an SDF to appoint an independent data auditor as well.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin