Data Protection Officers and contact persons under the DPDP Act

The contact person every Data Fiduciary needs

Section 8(9) asks every Data Fiduciary to publish the business contact information of a Data Protection Officer, if it has one, or of a person able to answer questions from Data Principals about the processing of their personal data. The Rules ask for this to be shown prominently on your website or app and mentioned in your responses to Data Principals.

For a mid sized D2C brand this is often someone in the legal or customer experience team, with a shared mailbox so questions do not depend on one person's inbox.

The Data Protection Officer of a Significant Data Fiduciary

Section 10 requires a Significant Data Fiduciary to appoint a Data Protection Officer. The Act sets four conditions for the role.

• The DPO represents the Significant Data Fiduciary under the provisions of the Act
• The DPO is based in India
• The DPO is an individual responsible to the Board of Directors or a similar governing body
• The DPO is the point of contact for the grievance redressal mechanism under the Act

The independent data auditor and the yearly DPIA

A Significant Data Fiduciary must also appoint an independent data auditor to evaluate its compliance with the Act, and carry out a Data Protection Impact Assessment and an audit periodically. The Rules set the period as once every twelve months, with the significant observations reported to the Data Protection Board.

The DPO usually owns the DPIA programme and the response to audit findings. The auditor's independence means the DPO cannot audit their own work.

What the role looks like in practice

At a private bank or a large hospital chain, the DPO typically chairs a privacy working group, approves new purposes and notices, tracks requests and grievances against their deadlines, and reports to the board on a fixed calendar. The role needs authority to stop a launch that skips a DPIA, which is why the reporting line to the board matters.

Timing and penalties

The duty to publish a contact person and the Significant Data Fiduciary duties apply in Phase 3, around 13 May 2027 as notified, unless amended. The Significant Data Fiduciary duties bite only once the Central Government has notified you. Breaching them can attract a penalty of up to 150 crore rupees.

How TrustOS helps

TrustOS gives the DPO or contact person one view of open requests, grievances, DPIAs, processor reviews and breach records, each with an owner and a due date. Board reports and audit evidence packs are built from the same records, so the auditor sees what the team actually did.

TrustOS does not decide who should be your DPO, whether a role conflict exists or whether your organisation is a Significant Data Fiduciary. Those are governance and legal decisions for your board and counsel, and TrustOS does not replace legal advice.