Internal note: appointment of Data Protection Officer
1. Appointment
Organisation (legal name):
Date of this note:
Name of the person appointed:
Designation:
Effective from:
Approved by (Board of Directors or similar governing body, with resolution reference):
2. What the Act asks of this role
Under s.10(2)(a) of the Digital Personal Data Protection Act, 2023, a Significant Data Fiduciary appoints a Data Protection Officer who meets the points below.
Represents the organisation under the Act.
Is based in India.
Is responsible to the Board of Directors or similar governing body.
Is the point of contact for the grievance redressal mechanism.
3. Location and reporting line
Place of work in India (address):
Responsible to (Board of Directors or similar governing body):
How often the DPO reports to that body:
Deputy or backup contact:
4. Responsibilities assigned by the organisation
Point of contact for grievances from Data Principals.
Oversight of the DPDP programme, including notices, consent, rights requests and breach response.
Coordination with the independent data auditor on the yearly DPIA and audit under Rule 13.
Other responsibilities:
Resources and budget available to the DPO:
5. Publication (Rule 9)
Rule 9 asks the organisation to publish the DPO's business contact information on its website or app, and to mention it in every response to a Data Principal.
Business email:
Business phone:
Web page or app screen where published:
Date published:
6. Sign-off
Signed for the organisation (name and designation):
Accepted by the Data Protection Officer (name):
Date: