Glossary
What is a Data Protection Officer under DPDP?
The DPDP Act requires a Data Protection Officer (DPO) of Significant Data Fiduciaries. Other Data Fiduciaries publish a contact person instead.
Definition
A Data Protection Officer (DPO) is the officer a Significant Data Fiduciary must appoint under s.10(2)(a) of the DPDP Act, 2023: based in India, representing the SDF, responsible to its Board of Directors or similar governing body, and the point of contact for grievances. Other Data Fiduciaries publish the business contact of a person who can answer questions about processing (s.8(9), Rule 9).
What it means
The DPO requirement attaches to SDF status. Until the Central Government notifies you as a Significant Data Fiduciary, the Act does not require you to appoint one.
Every Data Fiduciary must still publish, on its website or app, the business contact of its DPO or of the person who can answer questions about processing, and mention it in every response to a Data Principal (Rule 9). See how to appoint a DPO.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.10(2)(a) | SDF appoints a DPO: represents the SDF, based in India, responsible to the Board of Directors or similar governing body, point of contact for grievances |
| s.8(9) | Publish contact details of the DPO or responsible person |
| Rule 9 | Publish the business contact on the website or app; mention it in every response to a Data Principal |
| Rule 13 | SDF's yearly DPIA and audit |
Common misconceptions
- “Every company needs a DPO.” Only SDFs must appoint one under s.10(2)(a); others publish a contact under Rule 9.
- “The DPO can sit abroad.” For an SDF, the DPO must be based in India.
- “The DPO reports to the Data Protection Board.” The DPO is responsible to the SDF's own Board of Directors or similar governing body.
Related terms
A Data Fiduciary the Central Government notifies for extra duties (s.10).
Data auditorThe independent auditor a Significant Data Fiduciary appoints (s.10(2)(b)).
Grievance redressalThe fiduciary's complaint process, used before the Board (s.13).
Data Protection BoardThe Board established under s.18; no members appointed yet.
In TruePrivacy
The SDF workspace records the India-based DPO, with an address in India and a grievance contact. For any Data Fiduciary, the grievance desk handles complaints with SLA states and escalation.
Does every company need a DPO under DPDP?
No. s.10(2)(a) requires a DPO for Significant Data Fiduciaries. Every Data Fiduciary publishes the business contact of its DPO or of a person who can answer questions about processing (Rule 9).
Can the DPO be based outside India?
Not for an SDF. s.10(2)(a) requires the DPO to be based in India.
Who does the DPO report to?
The SDF's Board of Directors or similar governing body (s.10(2)(a)), not the Data Protection Board.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin