Does your Indian company need a Data Protection Officer under DPDPA?

With the Consent Manager framework going live on 13 November 2026 and MeitY's January 2026 proposal to pull Significant Data Fiduciary obligations forward still unresolved, "do we need a DPO?" is the question we hear most from CTOs and compliance heads. The answer under the Digital Personal Data Protection Act, 2023 is narrower than GDPR-trained advisers assume, but the duties that apply to everyone are broader than most Indian companies have planned for.

Who is legally required to appoint a DPO under the DPDP Act?

Only a Significant Data Fiduciary. Section 10(1) lets the Central Government notify any Data Fiduciary, or a class of them, as an SDF after assessing six factors: the volume and sensitivity of personal data processed, the risk to Data Principals' rights, the potential impact on India's sovereignty and integrity, risk to electoral democracy, security of the State, and public order. Designation is by notification; a company cannot opt in or self-classify, and until a notification names it, no company in India is an SDF.

Once notified, Section 10(2)(a) requires the SDF to appoint a Data Protection Officer who meets four tests. The DPO must represent the company under the Act, be based in India, be an individual responsible to the Board of Directors or a similar governing body, and be the point of contact for the grievance redressal mechanism. The Act prescribes no qualifications or certifications, but the reporting line to the Board is mandatory and distinguishes a DPDPA DPO from a GDPR-style officer who may report to management.

What else does Significant Data Fiduciary status trigger?

The DPO is one of several additional obligations and, in practice, the person who owns the rest. Section 10(2)(b) requires an independent data auditor to evaluate compliance. Rule 13 of the DPDP Rules, 2025 then sets the cadence: a Data Protection Impact Assessment and an audit once in every period of twelve months from the date the company is notified, with the auditor's significant observations reported to the Data Protection Board of India. Rule 13(3) adds algorithmic due diligence, requiring the SDF to verify that technical measures, including algorithmic software used to host, store, share or update personal data, are not likely to pose a risk to Data Principals' rights. Rule 13(4) allows the government, on the recommendation of a committee, to specify personal data and traffic data that an SDF may not transfer outside India.

The table sets the two tiers side by side; the left-hand column applies to every Data Fiduciary from 13 May 2027.

Obligation	Every Data Fiduciary	Significant Data Fiduciary (additional)
Named contact	Publish business contact of a DPO if applicable, or a person able to answer processing questions (Section 8(9), Rule 9)	Appoint an India-based DPO responsible to the Board (Section 10(2)(a))
Grievances	Readily available redressal mechanism; published response period of at most 90 days (Section 8(10), Rule 14)	DPO is the designated point of contact for grievances
Assessment and audit	Reasonable security safeguards; no mandated audit (Section 8(5))	Independent data auditor; DPIA and audit every 12 months, observations reported to the Board (Section 10(2)(b)–(c), Rule 13)
Algorithms	No specific duty	Due diligence that algorithmic software does not risk Data Principals' rights (Rule 13(3))
Cross-border transfer	Permitted except to countries the government restricts (Section 16, Rule 15)	Government may bar transfer of specified personal and traffic data (Rule 13(4))
Maximum penalty for the tier's specific failures	₹50 crore general; ₹250 crore for security safeguards	₹150 crore for Section 10 obligations, in addition to the general caps

Will your company be notified as a Significant Data Fiduciary?

Nobody can say for certain: no SDF notification has been issued and no thresholds published. The six factors in Section 10(1) point to scale and sensitivity rather than headcount: a lender holding KYC and credit data for millions, a hospital chain with health records, a telecom operator, a large e-commerce or social media platform. Law-firm commentary since 2025 has consistently expected financial, healthcare and telecom fiduciaries, and operators of large AI systems and search engines, to be among the first classes named. A 300-person SaaS company processing business contacts is unlikely to be designated; a 300-person fintech holding Aadhaar-linked repayment data could be.

Timing matters as much as scope. Section 10 of the Act and Rules 9, 13 and 14 sit in the 18-month group that takes effect on 13 May 2027. In January 2026 MeitY consulted industry on compressing the window to 12 months, which would bring those obligations and the first SDF notifications forward to 13 November 2026. As of late October 2026 no amendment had been gazetted, so 2027 stands, but a plausible SDF should budget as if the earlier date could arrive with little notice. Banks and NBFCs should read our analysis of whether RBI compliance already covers DPDPA; the short answer is that it does not, and SDF status would add a second layer.

What must an ordinary Data Fiduciary do instead of appointing a DPO?

Three things, and they are not optional. First, Section 8(9) requires every Data Fiduciary to publish the business contact information of its DPO "if applicable", or otherwise of a person who is able to answer, on the company's behalf, the questions a Data Principal raises about the processing of her personal data. Rule 9 specifies that this must be prominently published on the website or app and repeated in every response to a Data Principal exercising her rights. Second, Section 8(10) requires a readily available means of grievance redressal, and Rule 14 requires the company to publish the period within which it will respond, which may not exceed 90 days. Third, Section 5 requires every notice to explain how to complain to the Data Protection Board, and Section 13(3) requires individuals to exhaust your grievance process first, so your process is the Board's first filter.

The Act lets you skip the title, not the function: someone must be reachable, answer within the published window and show what was done. We set out how requests should flow in our guide to handling Data Principal rights requests.

Should you appoint a DPO even if you are not required to?

For most mid-size Indian companies the practical answer is to appoint a privacy lead with DPO-grade accountability without waiting to be told. The Section 8(9) contact has to be a real person who can answer, so you are naming someone anyway. If you are later notified as an SDF, the twelve-month DPIA and audit clock starts on notification day, leaving no time to build a function from scratch. Enterprise buyers in BFSI, healthcare and government already ask vendors for a named data protection contact in due diligence. And because a DPDPA DPO reports to directors, directors will want someone they trust in the seat before a regulator chooses the moment.

Cost need not be the barrier. Published 2026 estimates put a full-time Indian DPO at ₹12–18 lakh a year and a senior fractional DPO at ₹8–12 lakh, figures we examined in how much DPDPA compliance costs a mid-size company. The role need not be a new hire; it must be a named individual with time, authority and evidence.

How do you make a DPO, or a privacy lead, effective before May 2027?

Title or not, five steps turn an appointment into a function the Board, and the Data Protection Board, can rely on.

1. Write the mandate down. A board resolution or management order naming the individual, the reporting line, the time commitment and the authority to pause processing that breaches the Act.
2. Publish the contact in the Rule 9 places. Website and app footers, the privacy notice, every consent notice, and a template line in every rights response. Use a role mailbox so the contact survives staff changes.
3. Set and publish a grievance SLA inside the 90-day cap. Log every case and track time-to-close as a Board metric.
4. Run a DPIA-lite on your highest-risk processing now. CRM and marketing, HR, customer onboarding and any AI or scoring model. It builds the muscle Rule 13 demands of SDFs and produces the data map every other control depends on.
5. Keep evidence, not assertions. Consent records, notice versions, rights-request logs, breach drills and training registers, stored so they cannot be quietly edited. The DPO's job is to produce the record, not recall it.

This is the operating model DAPro (Data Adhikaar), Qodequay's DPDPA compliance platform, is built around: a tamper-evident Evidence Vault for the records a DPO must produce, notices in all 22 scheduled languages, rights and grievance workflows with SLA tracking, and 25+ connectors into the CRM, HRMS and support systems where personal data actually lives. Qodequay is ISO 9001:2015 and ISO 27001:2022 certified.

If you are deciding whether to appoint a DPO, or how to equip the one you have, we will map your Section 10 exposure and the Rule 9 and Rule 14 duties that apply regardless. Book a 30-minute DPDPA readiness call.

This article is for general information and is not legal advice. It reflects the DPDP Act, 2023 and the DPDP Rules, 2025 as notified at the time of writing; proposals under consultation may change the dates described. Confirm obligations against the official texts and consult qualified counsel for your situation.