DPDP Act 2023 · Section 10 · Rule 13 · Reviewed 11 Sep 2026
Under India’s DPDP Act, a Data Protection Officer (DPO) is required only for a Significant Data Fiduciary (SDF) that the Central Government notifies. The DPO must be an individual based in India, represents the SDF under the Act, is responsible to its Board or similar governing body, and is the contact for grievance redressal. Most compliance duties remain the legal responsibility of the Data Fiduciary or SDF — the DPO commonly coordinates them, but the statutory role itself is narrow.
Legal status — 11 September 2026
Statutory DPO trigger
Only notified Significant Data Fiduciaries
Section 10 status
Scheduled to commence 13 May 2027*
SDF designation status
No official SDF designation or list located in the primary sources reviewed
*Computed from the 18-month tranche in Rule 1(4), DPDP Rules 2025, unless changed by a later official notification. Last legally reviewed: 11 September 2026 against primary Government of India sources.
On this page
- Is a DPO mandatory under the DPDP Act?
- What Section 10 actually requires
- DPO duties vs Data Fiduciary / SDF duties
- What a DPO does day to day
- The two “Boards” you must not confuse
- Rule 13: the 12-month SDF cycle
- A DPO during a personal data breach
- Coordinating Data Principal requests
- Not an SDF — who owns privacy?
- Can a DPO be outsourced or fractional?
- Can the CISO, GC or Compliance Head be DPO?
- Certification and qualifications
- DPDP DPO vs GDPR DPO
- Penalties for SDF / DPO failures
- A practical 30-60-90 day plan
- Frequently asked questions
- Primary legal sources
1. Is a DPO mandatory under India’s DPDP Act?
Quick answer
No — not for every organisation. The statutory obligation to appoint a DPO applies only to a Significant Data Fiduciary notified by the Central Government under Section 10. There is no automatic size, turnover or sector threshold that turns a company into an SDF, and no organisation is an SDF until it is named (or falls within a notified class).
The DPDP Act creates one statutory route to a mandatory DPO: Section 10. It applies to a Significant Data Fiduciary — a Data Fiduciary, or class of Data Fiduciaries, that the Central Government notifies as significant under Section 10(1), weighing factors such as the volume and sensitivity of personal data processed, risk to Data Principals, risk to electoral democracy, security of the State and public order. Notification is the trigger. Being large, being a bank, being a technology company, or processing a lot of data does not by itself make an organisation an SDF.
As of 11 September 2026, no official Significant Data Fiduciary designation notification or official SDF list was located in the primary Government of India sources reviewed. Section 10 also sits in the tranche of provisions scheduled to commence on 13 May 2027, unless changed by a later official notification. That does not make privacy work optional today: the wider Data Fiduciary duties (notice, consent, security, breach intimation, rights handling) commence on the same date, and building the function early is how organisations that expect designation stay ahead of it.
2. What does Section 10 actually require the DPO to do?
Quick answer
Section 10 states four things about the DPO of an SDF: the DPO represents the SDF under the Act, is based in India, is an individual responsible to the Board or similar governing body, and is the point of contact for grievance redressal. Everything else people call a “DPO duty” is an operating-model choice, not an express statutory allocation.
It is worth reading Section 10 narrowly, because most online job descriptions quietly expand it. The statute is short and specific. Here is each element, what it safely implies, and — just as important — what it does not say.
Represent the SDF
The DPO represents the Significant Data Fiduciary under the Act.
Safe to infer
A named human accountable for the SDF’s DPDP interface.
Not stated
That the DPO personally performs or approves every compliance task.
Be based in India
The DPO must be based in India.
Safe to infer
An Indian point of presence and accountability.
Not defined
Citizenship, employee status, tax residence, or minimum physical office time.
Responsible to the Board
An individual responsible to the Board of Directors or similar governing body.
Safe to infer
Governing-body visibility of the privacy function.
Not stated
A direct reporting line, mandated Board meetings, or Board sign-off on every decision.
Grievance contact
Acts as the point of contact for the grievance-redressal mechanism.
Safe to infer
A reachable route for Data Principal grievances.
Not stated
That the DPO alone resolves grievances, or owns every Data Principal right.
What the law does not say
Section 10 does not state that the DPO personally conducts DPIAs, runs audits, owns security, submits breach notifications, trains all staff, independently monitors compliance, or approves every vendor. Those may be sensible operating responsibilities an organisation assigns internally — but they are not express personal statutory duties of the DPO.
3. DPO duties vs Data Fiduciary / SDF duties
Quick answer
Most DPDP obligations are legally owned by the Data Fiduciary or the SDF — not the DPO. Independent assurance sits with the independent data auditor. The DPO’s express statutory footprint is small; its practical footprint is large because it coordinates work it does not legally own. The table below keeps those two things separate on purpose.
This is the distinction competing DPO pages usually blur. Read the Legal owner column first: that is who a regulator holds responsible. The Express DPO role column is deliberately sparse — only four rows carry a statutory DPO tag — while the Practical DPO involvement column shows where a real privacy function adds value without changing legal ownership.
| Activity | Legal owner | Express DPO role | Practical DPO involvement |
|---|---|---|---|
| Appoint the DPO | SDF duty | — | N/A (the SDF appoints) |
| Represent the SDF under the Act | SDF duty | Statutory DPO | Acts as the named representative |
| Grievance-redressal contact | DF duty | Statutory DPO | Point of contact; routes and tracks resolution |
| Publish DPO / contact business info | DF duty | Statutory DPO | Is the published contact where applicable (s.8(9)/Rule 9) |
| Reasonable security safeguards | DF duty | — | Advises on privacy impact; coordinates with Security |
| Personal data breach notification | DF duty | — | Coordinates the privacy/legal workstream and drafting |
| Data Principal rights (access, correction, erasure) | DF duty | — | Runs intake, routing, verification governance, evidence |
| Erasure on withdrawal / purpose end | DF duty | — | Coordinates retention rules and downstream processor deletion |
| Processor contracts | DF duty | — | Privacy input to terms; risk escalation |
| Data Protection Impact Assessment (DPIA) | SDF duty | — | Coordinates scope, evidence, participation, remediation |
| Periodic audit programme | SDF duty | — | Audit readiness; evidence collection; tracking findings |
| Independent data audit | Independent auditor | — | Faces the auditor; supplies evidence (does not self-audit) |
| Algorithmic-software due diligence | SDF duty | — | Coordinates inventory and risk review with Product/Eng |
| Board / governing-body reporting | Recommended | — | Prepares the report; is responsible to the governing body |
| Privacy training and awareness | Recommended | — | Designs and coordinates the programme |
| Vendor privacy reviews | Recommended | — | Runs the review cadence; escalates risk |
Section 10, DPDP Act 2023 Rule 13, DPDP Rules 2025 Section 8, DPDP Act 2023
4. What does a DPO actually do day to day?
Away from the statute, the DPO (or the wider privacy function) mostly coordinates — pulling work across Legal, Security, Product, Engineering, HR, Procurement, Compliance, Risk, Internal Audit and senior management. The categories below group that work. In each, watch the split between a legal requirement owned elsewhere and a recommended operating practice the DPO runs in support.
A. Privacy governance
Governance calendar, policy ownership and coordination, an evidence register, and management reporting. Recommended
B. Data Principal rights
Request intake, routing, verification governance, escalation, and evidence. Legal duty of the Data Fiduciary; DPO coordinates.
C. Notice & consent governance
Notice review, consent-point review, withdrawal processes, and evidence. DF duty · DPO coordinates
D. Product / engineering privacy
New-product review, material data-use changes, AI/algorithmic systems, retention and deletion impact. Recommended
E. Third-party / processor governance
Processor onboarding, privacy contractual input, risk escalation, deletion/return assurance. DF duty
F. Security / incident coordination
Privacy impact, notification determination, notice drafting, documentation, post-breach remediation. Notification is a DF duty.
G. Audit / DPIA readiness
Evidence collection, stakeholder coordination, remediation tracking. DPIA/audit are SDF duties; the DPO readies them.
H. Board / management reporting
Periodic reporting to the governing body the DPO is responsible to. Recommended cadence
5. The two “Boards” you must not confuse
Board of Directors / similar governing body
What it is: the organisation’s own internal governing body.
Relationship to the DPO: the DPO is an individual responsible to this body under Section 10.
Nature: internal corporate governance — not a regulator.
Data Protection Board of India (DPBI)
What it is: the statutory regulatory and adjudicatory institution under the DPDP framework.
Relationship to the DPO: external. It receives breach intimations and adjudicates non-compliance; the DPO/DF interface with it.
Nature: a Government-established body, not part of the company.
Current status
The DPBI was legally established on 13 November 2025 (G.S.R. 844(E)). As of 11 September 2026, the primary-source record reviewed did not establish that its Chairperson and Members had been appointed, or that it was actively accepting and adjudicating DPDP complaints. In other words: established in law, not yet shown to be operational.
6. Rule 13: the SDF 12-month governance cycle
Quick answer
Once an organisation is notified as an SDF, Rule 13 sets a recurring obligation: once in each 12-month period (measured from the date it is notified as an SDF or included in a notified class) it must undertake a Data Protection Impact Assessment and an audit, carry out algorithmic/technical due diligence, and observe any conditional localisation the Government specifies. The SDF owns the obligation; the independent data auditor provides assurance; the DPO coordinates execution.
Rule 13 turns SDF status into a continuous cycle rather than a one-off project. Read the ownership carefully: the SDF must undertake the DPIA and audit; an independent data auditor performs the independent assurance; the DPO may coordinate scope, evidence and remediation but is neither the owner of the obligation nor the auditor.
Day 0 · Statutory
SDF designation
The 12-month clock starts from notification / class inclusion.
Statutory
Scope processing & DPIA
SDF undertakes the Data Protection Impact Assessment.
Statutory
Independent audit
Independent data auditor evaluates compliance.
Statutory
Significant findings
Algorithmic/technical due diligence; findings recorded.
Statutory
Corrective action
Remediation of gaps identified.
Statutory
Required reporting
Reporting as required under the SDF regime.
Recommended
Governing-body review
DPO reports to the Board / governing body.
Statutory
Next annual cycle
Repeat within each 12-month period.
7. What does a DPO do during a personal data breach?
Legal owner
Data Fiduciary. The obligation to intimate a personal data breach sits on the Data Fiduciary under Section 8(6) and Rule 7 — not on the DPO personally.
Practical DPO role
Coordinates the privacy/legal workstream: assesses DPDP implications, determines whether a personal data breach has occurred, drafts notices, and documents the response.
A breach is a cross-functional event. Security contains it, the DPO/privacy function assesses the DPDP implications, Legal assists interpretation, management authorises and escalates, and the Data Fiduciary makes the required intimations. The lane view below keeps each actor’s job separate.
8. How a DPO coordinates Data Principal requests
Quick answer
Data Principals can seek access, correction, completion, updating, erasure, grievance redressal and nomination. Meeting these requests is the legal responsibility of the Data Fiduciary (Rule 14); the DPO typically coordinates intake, verification and evidence, and is the grievance contact where applicable.
Request received
Classify the request type
Verify / validate the requester
Locate systems and processors
Assess retention / legal restrictions
Execute the response / action
Provide the outcome
Retain evidence
Grievance escalation where applicable
Ownership reminder: the legal responsibility to respond within the published period sits with the Data Fiduciary; the DPO runs the operating workflow around it.
9. If we are not an SDF, do we still need someone responsible for privacy?
Quick answer
You do not automatically need a statutory Section 10 DPO. But when Section 8(9) and Rule 9 apply, every Data Fiduciary must publish the business contact information of a DPO (if applicable) or another person able to answer Data Principal questions about processing. That contact is a privacy owner, not necessarily a statutory DPO.
These are two different things, and the titles should not be blurred:
Statutory DPO
Required only for a notified SDF (Section 10). Individual, India-based, responsible to the governing body, grievance contact.
Privacy contact / privacy owner
The person a non-SDF publishes under s.8(9)/Rule 9 to answer processing questions. Not a statutory DPO, but a real responsibility.
Practical ways non-SDFs fill the privacy-owner role include a privacy officer, a compliance owner, a legal/privacy contact, an external privacy adviser, or — where commercially justified — a dedicated DPO-style function even without designation.
Not sure whether you need a statutory DPO or a broader privacy owner?
Work through the trigger and your operating need before you hire.
Use the “Do I need a DPO?” checker →10. Can a DPO be outsourced, virtual or fractional?
What the law says
The DPDP Act and Rules do not expressly address outsourced, virtual, fractional or “DPO-as-a-Service” arrangements, and do not expressly state whether the DPO must be an employee. Claims that DPDP “expressly allows external DPOs” are not supported by the text.
What the law does require
The DPO must be an individual, based in India, who represents the SDF, is responsible to its Board or similar governing body, and is the grievance contact. Any practical arrangement has to satisfy these minimums.
What organisations should evaluate when considering an external or fractional arrangement: a named individual (not a faceless mailbox); accessibility and availability; genuine authority; confidentiality; conflicts of interest; an internal escalation route; Board access; service continuity; documentation and evidence; and grievance-response capability. These are governance considerations layered on top of the statutory minimums — they are practitioner interpretation, not statutory rules.
See how a Virtual DPO operating model can be structured if you are weighing a fractional or outsourced arrangement.
11. Can the CISO, General Counsel or Compliance Head also be the DPO?
Quick answer
The DPDP Act and Rules do not expressly prohibit a CISO, General Counsel, Compliance Head or Risk Head from also being the DPO. Whether it is wise is a governance question — about workload, conflicts, escalation and grievance neutrality — not a statutory one.
| Role | Potential advantage | Potential conflict | Key governance question | DPDP legal position |
|---|---|---|---|---|
| CISO | Deep security and breach fluency | Self-review of the security posture the DPO must assess | Can privacy assurance stay independent of security delivery? | Not expressly prohibited |
| General Counsel | Legal interpretation and privilege | Privilege can obscure privacy transparency; competing mandates | Does grievance neutrality survive the litigation lens? | Not expressly prohibited |
| Compliance Head | Existing controls and reporting muscle | Privacy diluted among many regimes | Is there real capacity and privacy depth? | Not expressly prohibited |
| Risk Head | Enterprise-risk visibility and Board access | Privacy treated as one risk line among many | Does the role carry operational privacy authority? | Not expressly prohibited |
| External adviser | Independence and specialist depth | Availability, context, internal authority | Named, reachable, authorised, India-based? | Not expressly addressed |
A recommended operating RACI (not a statutory allocation)
| Activity | DPO / Privacy | CISO | Legal / GC | Board / Mgmt |
|---|---|---|---|---|
| Notices | A/R | I | C | I |
| Privacy governance | A/R | C | C | I |
| Security safeguards | C | A/R | I | I |
| Breach response | C/R | A/R | C | A |
| Data Principal requests | A/R | C | C | I |
| DPIA | R | C | C | A |
| Independent audit support | R | C | C | A |
| Vendor processing | A/R | C | C | I |
| Algorithmic review | C/R | C | I | A |
| Board reporting | R | I | I | A |
This is a recommended operating RACI, not a statutory allocation chart. The DPDP Act assigns legal ownership to the Data Fiduciary / SDF, not to these functions.
12. Does a DPO need certification or specific qualifications?
What the law does not say
The DPDP Act and Rules do not prescribe a DPO certification, degree, privacy credential, law qualification, cybersecurity certification or minimum years of experience. Anyone claiming a mandatory DPDP DPO certificate is inventing a requirement.
Practical competence — not a statutory qualification list. Useful capability areas for whoever holds the role include: DPDP law; privacy operations; information governance; security literacy; incident response; vendor governance; product and data architecture; Board communication; audit and evidence management; and sector regulation where relevant. Weight these to your risk profile — they are hiring guidance, not legal prerequisites.
13. DPDP DPO vs GDPR DPO
Do not import GDPR into Indian law. Where the EU GDPR expressly regulates something the DPDP framework does not, the honest answer is “not expressly addressed by DPDP Act/Rules” — not a manufactured equivalent.
| Topic | India — DPDP | EU — GDPR |
|---|---|---|
| Appointment trigger | Only a notified Significant Data Fiduciary (s.10) | Public authority, large-scale monitoring, or large-scale special-category processing (Art 37) |
| Role definition | Represents SDF; India-based; responsible to governing body; grievance contact | Detailed tasks in Art 39 (advise, monitor, cooperate, contact point) |
| Location requirement | Must be based in India | No express location rule; must be accessible |
| Governing-body relationship | Responsible to the Board / similar governing body | Reports to highest management level (Art 38) |
| Independence | Not expressly addressed by DPDP Act/Rules | Express: must not receive instructions on tasks (Art 38) |
| Conflicts of interest | Not expressly addressed by DPDP Act/Rules | Express: other tasks must not conflict (Art 38) |
| Resources | Not expressly addressed by DPDP Act/Rules | Express: adequate resources required (Art 38) |
| Dismissal protection | Not expressly addressed by DPDP Act/Rules | Express: no penalty/dismissal for performing tasks (Art 38) |
| DPIA role | SDF undertakes DPIA (Rule 13); DPO may coordinate | DPO advises on and monitors the DPIA (Art 35/39) |
| Monitoring compliance | Not an express statutory DPO task | Express task of the DPO (Art 39) |
| Training / awareness | Not expressly addressed by DPDP Act/Rules | Part of the DPO’s awareness role (Art 39) |
| External / service-contract DPO | Not expressly addressed by DPDP Act/Rules | Expressly permitted via service contract (Art 37(6)) |
| Penalties (context) | SDF obligations up to ₹150 cr; security up to ₹250 cr; breach-notification up to ₹200 cr | Up to €20m or 4% of global turnover |
14. What happens if an SDF does not meet its DPO obligations?
The DPDP Act sets maximum penalty ceilings, applied by the Data Protection Board after inquiry — they are not automatic fines, and failing to appoint a DPO does not automatically attract the highest figure.
₹150 cr
Section 10 / SDF additional obligations
₹200 cr
Section 8(6) breach notification
₹250 cr
Section 8(5) reasonable security safeguards
These are statutory maximums. The Board weighs the nature, gravity and duration of the breach and mitigating factors before deciding any amount. Treat them as ceilings that shape governance priorities — not as a fear-based price list.
15. A practical 30-60-90 day DPO plan
Recommended operating model — not a statutory DPDP timeline
Nothing below is prescribed by the Act. It is a sensible sequence for standing up a privacy function — useful whether you are a designated SDF or a Data Fiduciary building ahead of the 13 May 2027 commencement.
Days 1–30
Establish
- Mandate / role charter
- Governing-body relationship
- Contact and grievance channels
- Stakeholder map
- Privacy-process inventory
- Data / process baseline
- Notices & consent review
- Rights / grievance process review
- Incident-process review
Days 31–60
Operationalise
- Rights workflow
- Grievance SLA
- Breach playbook
- Vendor / privacy intake
- Product-review process
- Risk register
- Board dashboard
- Evidence register
Days 61–90
Assure
- DPIA / audit readiness
- Algorithmic-system inventory
- Breach tabletop
- Remediation tracker
- Training programme
- Management reporting
- Annual governance calendar
16. Frequently asked questions
Is a DPO mandatory under India’s DPDP Act?
Which organisations must appoint a DPO?
Are any Significant Data Fiduciaries officially notified?
When does the DPDP DPO requirement take effect?
Must a DPO be based in India?
Who does the DPO report to under Section 10?
Can a DPO be outsourced or fractional?
Does the DPDP Act require DPO certification?
Can a CISO or General Counsel also be DPO?
What does a DPO do during a personal data breach?
Is the DPO responsible for DPIAs and audits?
What is the maximum penalty for breaching Section 10 obligations?
Need help building your DPDP privacy function?
Whether you expect SDF designation or are appointing a privacy owner ahead of commencement, we can help you structure the role correctly.
Explore DPO & privacy support →17. Primary legal sources
| Source | Date | Why it matters |
|---|---|---|
| Digital Personal Data Protection Act, 2023 | 11 Aug 2023 | The primary statute; Section 10 (SDF/DPO), Section 8 (DF duties), Schedule (penalties). |
| G.S.R. 843(E) — commencement notification | 13 Nov 2025 | Brings the Act into force in phases; anchors the 13 May 2027 tranche. |
| G.S.R. 844(E) — Data Protection Board | 13 Nov 2025 | Legally establishes the Data Protection Board of India. |
| Digital Personal Data Protection Rules, 2025 — G.S.R. 846(E) | 13 Nov 2025 | Operative detail: Rule 7 (breach), Rule 9 (contact), Rule 13 (SDF cycle), Rule 14 (rights). |
| G.S.R. 892(E) — corrigendum | 10 Dec 2025 | Corrections to the notified Rules. |
MeitY e-Gazette of India DPDP Act 2023 text DPDP Rules 2025 text
Last legally reviewed: 11 September 2026
Research basis: Digital Personal Data Protection Act, 2023; Digital Personal Data Protection Rules, 2025; and the relevant Gazette notifications and corrigendum (G.S.R. 843/844/846/892(E)).
Review standard: reviewed against primary Government of India sources.
The bottom line
The statutory DPO role under India’s DPDP framework is narrower than the broad privacy-office job descriptions commonly found online. Section 10 fixes four things — an India-based individual who represents the SDF, is responsible to its governing body, and is the grievance contact — and applies only to notified Significant Data Fiduciaries. The organisation, not the DPO, remains legally responsible for most DPDP obligations. A strong DPO function earns its place by coordinating those obligations across the business while holding the statutory relationship Section 10 defines. Get that distinction right and everything else — DPIAs, audits, breach response, rights — falls into place around the correct legal owner.
Next steps: what a Data Protection Officer is · do we need a DPO? · a DPO for the DPDP Act · Virtual DPO model
This guide explains the DPDP framework based on primary sources reviewed as of the date shown above. Several substantive provisions are subject to phased commencement and future notifications. It is general information, not legal advice.
Talk to a DPO on WhatsApp. We use your number only to reply to you, and never add you to any marketing list without your consent.
Chat on WhatsApp