How to Appoint a Data Protection Officer (DPO) Under DPDP Act

Under the DPDP Act, only a Significant Data Fiduciary (SDF) is legally required to appoint a Data Protection Officer. Every other business must still publish the contact details of someone who can answer people's questions about their data. Both duties take effect on 13 May 2027, when the core DPDP Rules 2025 come into force.The DPO under the DPDP Act must be based in India, report to the board of directors or equivalent governing body, represent the company under the Act, and act as the point of contact for grievance redressal.This guide explains who needs a DPO, what the law requires of the role, and how to make the appointment step by step.

DPO DPDP Act requirements: what the law says

Section 10(2)(a) of the DPDP Act sets four conditions for the DPO of a Significant Data Fiduciary. Section 8(9) and Rule 9 add a publication duty that applies to every Data Fiduciary.

Requirement	Source	What It Means in Practice
Represents the SDF under the Act	Section 10(2)(a)	The DPO is the company's face to the Data Protection Board and to individuals on data protection matters.
Based in India	Section 10(2)(a)	A DPO sitting in a foreign group office does not satisfy the law.
An individual responsible to the board of directors or similar governing body	Section 10(2)(a)	The role must be held by a named person, not a team or a firm, with a direct reporting line to the board.
Point of contact for grievance redressal	Section 10(2)(a)	Complaints from Data Principals route to the DPO's office.
Business contact details published	Section 8(9), Rule 9	Display the DPO's (or contact person's) details prominently on your website or app, and include them in every response to a rights request.

What a DPO does

The DPO owns day-to-day accountability for how the company handles personal data. The Act names only representation and grievance redressal, but in practice the role also anchors the SDF's other obligations.

• • Grievance redressal: Receive and resolve complaints from Data Principals within the 90-day window set by the Rules, before they escalate to the Board.
• • Rights requests: Oversee requests to access, correct, erase or nominate, and make sure responses carry the published contact details.
• • Board liaison: Act as the company's contact for the Data Protection Board during inquiries and breach intimations.
• • DPIA and audit: Coordinate the annual Data Protection Impact Assessment and the audit by the independent data auditor that an SDF must appoint under Section 10(2)(b).
• •Breach response: Help lead notifications to affected individuals and the Board, including the detailed report due within 72 hours.
• • Governance and training: Brief the board on risks, keep policies current, and train staff who handle personal data.

How to appoint a DPO: step by step

Plan for the appointment to take two to three months, so start by early 2027 at the latest.

• Confirm whether you are, or could become, an SDF. Watch for Central Government notifications under Section 10(1), which weigh the volume and sensitivity of data, risk to individuals, and impact on sovereignty, electoral democracy, State security and public order. If you are not an SDF, decide whether to appoint a DPO voluntarily or name a contact person.
• Define the role.Write a charter covering responsibilities, the reporting line to the board, budget, and authority to access systems and records.
• Set selection criteria.Look for knowledge of the DPDP Act and Rules, familiarity with your data flows and technology, investigation and communication skills, and the seniority to push back on business teams.
• Check for conflicts of interest. The Act is silent here, but a DPO who also heads marketing, sales or IT may be judging their own decisions. Choose someone who can stay independent.
• Confirm India residency. The DPO must be based in India. If your group DPO sits abroad, appoint an India-based individual for the Indian entity.
• Get board approval. Pass a board resolution naming the DPO, recording the reporting line and the role's authority.
• Issue a formal appointment letter. Include the charter, reporting line, resources and confidentiality terms.
• Publish the contact details. Place the DPO's business contact details prominently on your website and app, add them to privacy notices, and include them in responses to rights requests, as Rule 9 requires.
• Set up the grievance process.Create an intake channel, tracking, escalation paths and a clock for the 90-day response window.
• Equip and review. Give the DPO a team or budget, schedule regular board reporting, and review the role each year alongside the DPIA and audit.

In-house or outsourced DPO?

An SDF's DPO must be an individual responsible to its board, so a fully outsourced DPO-as-a-service is a weak fit for SDFs. Outside support works best behind a named in-house DPO.

Factor	In-house DPO	Outsourced or External DPO
Fit with Section 10 for SDFs	Strong: a named employee reporting to the board	Risky: the law expects an individual answerable to the board
Knowledge of Your Business	Deep and continuous	Built up over time, often partial
Independence	Needs active protection from internal pressure	Naturally more distance from business teams
Cost	Full salary and team	Retainer, usually lower for smaller firms
Best For	SDFs and large data-driven businesses	Non-SDFs naming a contact person, or SDFs supplementing an in-house DPO

Common mistakes to avoid

• Naming a foreign group DPO. The DPO under the DPDP Act must be based in India.
• Giving the title to a junior employee. Without a line to the board and real authority, the DPO cannot do the job the Act describes.
• Assuming the IT Rules grievance officer is enough. A grievance officer appointed under the IT Rules 2021 may handle similar complaints, but the DPDP role has its own requirements. One person can hold both only if they meet both sets.
• Hiding the contact details. A buried email address in a long privacy policy does not meet the "prominently published" standard of Rule 9.
• Waiting for SDF notification. If your data volumes or sensitivity put you in scope, notification may come with little warning. Prepare the role in advance.

Deadlines and penalties

DPO and contact-person duties apply from 13 May 2027, when Rules 9 and 12 and the matching sections of the Act come into force. (Confirm against the Gazette: if the Rules were notified on 14 November 2025, the date is 14 May 2027.)Failing to meet the additional obligations of a Significant Data Fiduciary, which include appointing a DPO, can draw a penalty of up to ₹150 crore. Failing to publish contact details as required falls under the residual category, with a penalty of up to ₹50 crore.

To know more,Visit our DPDP Compliance Page

Frequently asked questions

• Is a DPO mandatory under the DPDP Act? Only for Significant Data Fiduciaries. Other Data Fiduciaries must publish the contact details of a DPO, if they have one, or of a person who can answer questions about their processing.
• Can the DPO be based outside India? No. Section 10(2)(a) requires the DPO of a Significant Data Fiduciary to be based in India.
• Who does the DPO report to? The board of directors or a similar governing body of the Significant Data Fiduciary.
• What qualifications does a DPO need under the DPDP Act? The Act and Rules prescribe none. In practice, look for knowledge of Indian data protection law, technical understanding of your systems, and enough seniority to influence decisions.
• Can one person be both the DPO and the grievance officer? Yes, if that person meets the requirements of both roles. Many companies combine them to give individuals a single point of contact.
• When must a DPO be appointed? By 13 May 2027 for existing Significant Data Fiduciaries, or promptly after a company is notified as one.

The bottom line

If you are a Significant Data Fiduciary, you need an India-based DPO reporting to your board by 13 May 2027. If you are not, you still need a published contact person, and appointing a DPO voluntarily is often the simplest way to meet that duty well. Either way, start now: defining the role, getting board approval and building the grievance process takes months.

The DPO is one item on a longer list. Use our DPDP compliance checklist to cover notices, consent, security, breach response and data principal rights before the deadline.

Use Pixl to expand your business opportunities

Ready to transform? Commence your Digital Transformation journey now!

Get Started