Who needs a Data Protection Officer under the DPDP Act?

“Do we need a Data Protection Officer?” is one of the first questions organisations ask about India’s DPDP Act, 2023. The short answer: a DPO is mandatory for Significant Data Fiduciaries, and every other organisation still needs someone who can answer questions about how it uses personal data.

Who must appoint a DPO

The Central Government can notify any Data Fiduciary, or a class of them, as a Significant Data Fiduciary (SDF). It considers factors such as:

• the volume and sensitivity of the personal data processed
• the risk to the rights of Data Principals
• the potential impact on India’s sovereignty and integrity, electoral democracy, state security and public order

Large platforms, banks, insurers, hospitals and telecom operators are likely candidates, but the decision is the Government’s.

An SDF must appoint a Data Protection Officer who:

• represents the SDF under the Act
• is based in India
• is responsible to the Board of Directors or a similar governing body
• is the point of contact for the grievance redressal mechanism

What else an SDF must do

Besides the DPO, an SDF must appoint an independent data auditor, carry out periodic Data Protection Impact Assessments and audits, and take other measures the Rules require. The DPDP Rules, 2025 add duties such as checking that algorithmic software does not put people’s rights at risk.

What about everyone else?

Organisations that are not SDFs do not have to appoint a formal DPO. They must still publish the contact details of a person who can answer Data Principals’ questions about the processing of their personal data, either a DPO if they have one or another designated person. Many organisations appoint a DPO anyway, because it gives privacy a clear owner.

What a good DPO does

• keeps a map of what personal data the organisation holds and why
• reviews notices, consent flows and contracts with vendors
• leads breach response and the 72-hour report to the Board
• handles rights requests and grievances
• trains staff and reports to senior management on privacy risk

Becoming a DPO

The role needs a mix of law, governance and practical security knowledge. Our Certificate Programme in Data Protection & Privacy Officer (DPPO) covers the DPO’s role, the Data Protection Board, vendor governance, cross-border transfers and AI privacy in ten online units. See the DPPO programme.

This article is for education and is not legal advice.