Data Protection Officer in India: Who Needs One and What They Do

ConsentifyAI Team12 October 20262 min read

TL;DR

Only Significant Data Fiduciaries must appoint a Data Protection Officer under the DPDP Act. The DPO must be based in India, represent the SDF, answer to its board and act as the point of contact for grievances. Every other fiduciary must still publish the business contact details of a DPO or another person who can answer questions about its processing. Many organisations appoint a privacy lead anyway, because someone has to own the programme.

Who this is for: founders, boards and compliance leaders deciding whether to appoint a Data Protection Officer and how to set up the role.

Under the GDPR, many organisations must appoint a DPO. The DPDP Act takes a narrower approach: only Significant Data Fiduciaries must have one. But every organisation needs someone individuals can contact, and every DPDP programme needs an owner.

Who must appoint a DPO

Section 10(2)(a) requires every Significant Data Fiduciary to appoint a Data Protection Officer who:

represents the SDF under the Act
is based in India
is an individual responsible to the board of directors or similar governing body
is the point of contact for the grievance redressal mechanism

See Significant Data Fiduciary for who may be designated.

Everyone else: the contact-person duty

Section 8(9) requires every Data Fiduciary to publish the business contact information of its DPO, if it has one, or of a person who can answer Data Principals' questions about the processing of their personal data. Rule 9 requires this to be published prominently on your website or app and mentioned in every response to a person exercising their rights. Section 6(3) also requires these contact details in consent requests.

So even without a DPO, you need a named, reachable function, and the person behind it needs to know the answers.

What a DPO (or privacy lead) actually does

Area	Responsibilities
Governance	Owns the DPDP programme, reports to the board, sets policy
Data map	Keeps the [ROPA](/blog/ropa-dpdp) current
Consent and notices	Approves purposes, notices and consent flows
Rights and grievances	Oversees requests and the 90-day grievance limit
Risk	Runs [DPIAs](/blog/dpia-india) for high-risk processing (annually for SDFs)
Vendors	Reviews processor contracts and risk
Breaches	Leads or advises on Rule 7 notifications
Audit	Works with the independent data auditor (SDFs)
Training	Builds awareness across teams

Setting up the role

Independence. The DPO should be able to raise concerns without being overruled by the teams whose processing they assess.
Seniority. Direct access to the board or CEO.
Resources. A small team or external support; one person cannot run a large programme alone.
Conflicts. Combining the DPO role with heads of marketing, IT or business units creates conflicts. Combining it with legal or compliance can work if decision rights are clear.
Skills. Knowledge of the DPDP Act, data and systems, and the ability to work across teams.

Common mistakes

Publishing a generic inbox nobody monitors. Section 8(9) contact details must lead to someone who can answer.
Naming a DPO in title only. SDF DPOs have statutory responsibilities.
No board reporting line. Required for SDF DPOs and valuable for everyone.

How ConsentifyAI helps

ConsentifyAI gives the DPO or privacy lead one place to run the programme: the ROPA, consent and notices, rights and grievance tracking, DPIAs and compliance reporting for the board, all backed by a tamper-evident audit trail.

Sources & references

DPDP Act, 2023 — Section 8(9)
DPDP Act, 2023 — Section 10(2)(a)
DPDP Act, 2023 — Section 6(3), 13
DPDP Rules, 2025 — Rule 9, Rule 13

Frequently asked questions

Is a DPO mandatory under the DPDP Act?

Only for Significant Data Fiduciaries, under Section 10(2)(a).

What are the DPO's requirements?

The DPO must be based in India, represent the SDF under the Act, be an individual responsible to the board of directors or similar governing body, and be the point of contact for grievance redressal.

What if we are not an SDF?

Section 8(9) requires you to publish the business contact information of a DPO, if you have one, or of a person able to answer Data Principals' questions about your processing.

Can the DPO be outsourced?

The Act requires the SDF's DPO to be an individual based in India responsible to its board. Organisations can use external support, but the statutory role must meet those conditions.

Can the CISO or compliance head be the DPO?

Possibly, but consider conflicts of interest and capacity. The DPO's job is to represent data protection, which can conflict with roles that decide on processing.