Section 10
How to appoint a DPDP Data Protection Officer
Only a Significant Data Fiduciary must appoint a Data Protection Officer under DPDP. Here is what s.10(2)(a) requires and how to make the appointment.
Short answer
Under s.10(2)(a) of the DPDP Act, a Significant Data Fiduciary must appoint a Data Protection Officer, and the Central Government notifies who is an SDF. The DPO must represent the SDF, be based in India, be responsible to the Board of Directors or a similar governing body, and be the point of contact for grievance redressal. Every other Data Fiduciary must still publish the business contact of a person who can answer questions about its processing (s.8(9), Rule 9).
Who must appoint a DPO
The duty applies to Significant Data Fiduciaries. The Central Government notifies SDFs under s.10, alone or as a class, based on factors such as the volume and sensitivity of personal data, risk to Data Principals' rights, and potential impact on the sovereignty and integrity of India, electoral democracy, security of the State and public order.
No numeric thresholds have been notified, and we know of no SDF designated so far. If you are not an SDF, you still publish the business contact of the person who can answer questions about processing, and mention it in every response to a Data Principal (Rule 9). You may give that person the DPO title, but for a non-SDF it is a choice, not a duty.
What s.10(2)(a) requires of the DPO
| Requirement | What to check |
|---|---|
| Represents the SDF under the Act | The appointment gives the DPO authority to speak for the company on DPDP matters |
| Based in India | The DPO is based in India; an officer based abroad does not meet this |
| Responsible to the Board of Directors or similar governing body | A direct reporting line to the board or a board committee, recorded in governance documents |
| Point of contact for grievance redressal | Grievances reach the DPO, and the DPO's business contact is published (s.8(9), Rule 9) |
Steps to appoint a DPO
- 01Confirm the trigger
Appoint once the government notifies you as an SDF, or earlier if you choose. Keep the notification reference with the appointment record.
- 02Write the role
Set out the s.10(2)(a) duties, the board reporting line, the grievance role and the Rule 13 tasks the DPO will coordinate.
- 03Choose the person
Look for working knowledge of the DPDP Act, your systems and your sector. The person must be based in India.
- 04Check for conflicts
The Act does not list conflicts for the DPO. As good governance, avoid a person who would review their own decisions, such as the head of a team whose processing the DPO must challenge.
- 05Approve at board level
Record the appointment in a resolution of the board or governing body, with the reporting line and resources.
- 06Publish the contact
Publish the DPO's business contact on your website or app and include it in every response to a Data Principal (s.8(9), Rule 9).
- 07Set the reporting rhythm
Agree how often the DPO reports to the board and what each report covers. The board reporting guide suggests measures.
Plan for the other SDF duties
A DPO rarely works alone. An SDF must also appoint an independent data auditor (s.10(2)(b)) and undertake a periodic Data Protection Impact Assessment, a periodic data audit and other measures (s.10(2)(c)). Rule 13 adds:
- A DPIA and an audit once every twelve months, with significant observations furnished to the Board
- Due diligence that algorithmic software does not risk Data Principals' rights
- Keeping personal data the Central Government specifies, on a committee's recommendation, and related traffic data within India
Appointment checklist
- SDF notification reference recorded, or a note that the appointment is voluntary
- Named person based in India
- Board or governing body resolution with the reporting line
- Role description covering grievances and Rule 13 tasks
- Conflict check documented
- Business contact published on the website and app
- Contact included in every response template
- Independent data auditor identified (s.10(2)(b))
No SDF thresholds are notified, and the Data Protection Board has no members yet. Check with counsel before you treat your company as an SDF, or as outside SDF scope.
How TruePrivacy helps
The SDF workspace records the designation (date and government notification reference), the India-based DPO with an address in India and a grievance contact, and the independent data auditor. Yearly clocks for the DPIA, the data audit and algorithmic due diligence start once you record the designation.
Grievances run through the grievance desk with the DPDP 90-day limit as the clock. Related tools: the DPO appointment note and the Am I an SDF? check.
Does every company need a DPO under DPDP?
No. Only Significant Data Fiduciaries must appoint one (s.10(2)(a)). Every Data Fiduciary must publish the business contact of a person who can answer questions about processing (Rule 9).
Can the DPO be based outside India?
No. Section 10(2)(a) requires the DPO to be based in India.
Who does the DPO report to?
The DPO is responsible to the Board of Directors or a similar governing body of the SDF (s.10(2)(a)). That is the company's own board, not the Data Protection Board of India.
Is there a threshold that makes a company an SDF?
No numeric threshold has been notified. The Central Government notifies SDFs based on the factors in s.10.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin